API Negative Testing: Design Rejection and Safety Checks

Turn field constraints, permissions, limits, and state rules into bounded invalid-input cases with response and side-effect checks.