An agent benchmark passes every happy-path task but has no tests for denied operations. What is missing?

1. More greeting variants
2. A larger display font
3. Random changes to the expected answers
4. Negative tests for authorization, tool failures, and unsafe or unsupported requests