Use ICP ingress inspection without exposing an admin method
A canister's inspect_message hook can reject unwanted ingress early. Authorization still belongs inside every privileged update method.
Exercise a second route
Suppose set_fee rejects ordinary users during ingress inspection but immediately assigns its argument in the method body. Invoke it from a test canister as well as through an agent. Inter-canister messages bypass the ingress inspection hook, so the test exposes any missing caller check in the method itself.
user U → ingress inspection → administrative method
canister C → administrative method
Keep admission checks inexpensive
Reject obviously unsupported methods or oversized arguments early where appropriate, then check the current caller and permissions again during execution. A policy based on mutable state can change between admission and execution. Include successful and rejected paths in tests for both message origins.