Can I test a workflow without touching real systems?

Not by pretending. A test fire is an ordinary run: same engine, same credentials, same code, same consequences. Nothing is stubbed and nothing is mocked. If the step sends an email, a test run sends the email.

That is on purpose. A test that passes against a fake is a test of the fake, and the failures worth catching are the ones that only happen against the real service.

What a test run changes is bookkeeping. It is scratch: no example is recorded, it does not count toward readiness, and a failure does not open a repair review or push the workflow back to learning. You can also fire one against a draft version of the procedure without disturbing the published one, and against a sample payload rather than waiting for a real event.

There is no separate staging environment. What you have instead is publish and pause. An unpublished or paused workflow has no armed trigger, so nothing outside can start it, and pausing also stops the runs already in flight.

The safety net during a test is the one that runs the rest of the time. An agent step asks before it does anything consequential, and a gate you pinned fires on a test fire exactly as it would on a real one. That is what stands between a test and a consequence you did not want.