Where does the decision actually happen?
Ask whether policy decisions are made in one identifiable place, evaluated consistently, or scattered across application code as ad hoc checks that happen to enforce something similar. The first can be tested and reviewed as a unit; the second usually cannot be, because there is no single implementation to point to.
Ask what happens when the decision-making component cannot be reached — whether the default is to deny or to proceed. That answer is rarely advertised, and it is one of the more consequential facts about any system.
Who can change the rules, and is that recorded?
Ask who can modify policy, and whether that change goes through the same review discipline as any other consequential action, or is treated as routine configuration. A system with excellent enforcement and an unreviewed path to changing the policy it enforces has a hole exactly where the enforcement was supposed to matter most.
Ask whether a past decision can be independently re-verified — given the recorded inputs and the policy version in force at the time, can someone who does not operate the system confirm the outcome was correct? If the honest answer is 'only by trusting our logs,' that is worth knowing before relying on the system for anything that might need to be reconstructed later.
What happens to a compromised identity?
Ask how quickly a credential or an identity can actually be cut off once something is known to be wrong with it, and whether that path has been exercised outside of a real incident. A revocation procedure that has never been tested is a hypothesis, not a capability.