Separate the action from the outcome.
A configured Block rule is a starting point. Check that the intended integration is active, repeat the workflow, and confirm both the submission outcome and the recorded event.
Say where the boundary is.
A policy may apply to one supported workflow without covering every way to use the same AI service. Document the tested path and make unverified paths visible.
Treat the device state as part of the answer.
Paused enforcement and a healthy, active integration are different states. Report that distinction plainly, alongside any result being used as evidence.