Runs the real signing door against disposable fixtures and reports what this session is allowed. Refusals can only be proved from an ordinary (non-admin) account.
Steps
1. Administrator: “Create my fixtures”, then copy the two ids.
2. Sign in as the ordinary account under test.
3. Open /private-access-check?upload_id=<id>&record_id=<id> and run the probes.
4. Administrator: “Delete my fixtures”.
No foreign fixture ids in the URL, so the cross-account probes will be reported as not run.