11.8Pattern 7: Negative Testing

Verify that the application correctly rejects invalid operations.

Example: Unauthorized Access

# Try to access admin page without login
playwright-cli goto https://app.example.com/admin
playwright-cli eval "location.href"
# → Agent verifies: redirected to /login (not /admin)

playwright-cli snapshot
# → Agent verifies: heading "Please log in" (not admin content)

Example: Rate Limiting

# Rapid-fire requests (ref e5 = submit button from the current snapshot)
for i in $(seq 1 10); do
  playwright-cli click e5
  playwright-cli eval "document.querySelector('.response')?.textContent"
done
# Agent checks if rate limiting kicked in