Assert the current session is refused a path: a 403 or 404, a redirect to the login form, or core's "Access denied" page. One step for what otherwise takes a navigation, a status check and a title check.
Examples
Then I should be denied access to "/admin/people"
And I am denied access to "/admin/config"
Then we should be denied access to "/node/add/article"
And I should be refused "/admin/modules"
Then I am refused "/admin/reports/status"
Pattern
Then(/^(I |we )*(?:am|are|should be) (?:denied access to|refused) "([^"]*)"$/, …)
Part of @webship-js/drupal-core-steps (github.com/webship/drupal-core-steps), a step pack for Webship-js 2.0.x.