Is it possible to verify that you cannot access said system, though? How would that even be done? In most scenarios I can imagine you're still rely on the serve

Is it possible to verify that you cannot access said system, though? How would that even be done? In most scenarios I can imagine you're still rely on the server telling you something about itself... which it can lie about.