diff --git a/tests/integration/test_matrix_live.py b/tests/integration/test_matrix_live.py
index e835d4b..1bf8922 100644
--- a/tests/integration/test_matrix_live.py
+++ b/tests/integration/test_matrix_live.py
@@ -33,6 +33,27 @@ pytestmark = [
 ]
 
 
+def _assert_testing_identity(transport: MatrixTransport, config: MatrixConfig) -> None:
+    """Two invariants that only a live homeserver can check.
+
+    The configured user id must be the token's real owner, because the
+    transport filters its own messages by comparing sender to that value —
+    a mismatch would make the bot read its own posts as operator input.
+    And tests must run as a testing identity, so a stray live run can never
+    act as the production agent.
+    """
+    whoami = transport._http.get("/account/whoami")
+    whoami.raise_for_status()
+    actual = whoami.json()["user_id"]
+    assert actual == config.user_id, (
+        f"NISSE_MATRIX_USER_ID is {config.user_id} but the token belongs to "
+        f"{actual}; the self-message filter would not match"
+    )
+    assert "testing" in actual, (
+        f"live tests must run as a testing identity, not {actual}"
+    )
+
+
 def test_send_lands_in_test_room() -> None:
     missing = [var for var in ALSO_REQUIRED if not os.environ.get(var)]
     assert not missing, (
@@ -43,6 +64,7 @@ def test_send_lands_in_test_room() -> None:
     marker = f"transport smoke test {uuid.uuid4().hex}"
     transport = MatrixTransport(config)
     try:
+        _assert_testing_identity(transport, config)
         transport.send_message(marker)
         response = transport._http.get(
             f"/rooms/{config.room_id}/messages",