Test API credential permissions separately from your service catalog

A practical allowlist check, an offline Python guard, and an acceptance matrix for separating portal visibility from API credential permissions.