diff --git a/lib/services/remediation-default-params.test.ts b/lib/services/remediation-default-params.test.ts
new file mode 100644
index 0000000..7b3c13c
--- /dev/null
+++ b/lib/services/remediation-default-params.test.ts
@@ -0,0 +1,75 @@
+import { describe, it, expect } from 'vitest';
+import { deriveDefaultParams, type DefaultParamEvidence } from './remediation-default-params';
+
+const filledEvidence: DefaultParamEvidence = {
+  requesterEmail: 'requester@wulfconsulting.test',
+  senderEmail: 'attacker@evil.test',
+  senderDomain: 'evil.test',
+  messageId: 'message-123',
+};
+
+const emptyEvidence: DefaultParamEvidence = {
+  requesterEmail: null,
+  senderEmail: null,
+  senderDomain: null,
+  messageId: null,
+};
+
+describe('deriveDefaultParams', () => {
+  it('returns {} for no_action', () => {
+    expect(deriveDefaultParams('no_action', filledEvidence)).toEqual({});
+  });
+
+  it('returns recipientEmail + empty message for warn_user, using requesterEmail', () => {
+    expect(deriveDefaultParams('warn_user', filledEvidence)).toEqual({
+      recipientEmail: 'requester@wulfconsulting.test',
+      message: '',
+    });
+  });
+
+  it('returns senderEmail + senderDomain for block_sender', () => {
+    expect(deriveDefaultParams('block_sender', filledEvidence)).toEqual({
+      senderEmail: 'attacker@evil.test',
+      senderDomain: 'evil.test',
+    });
+  });
+
+  it('returns messageId + empty mailboxes for purge_message', () => {
+    expect(deriveDefaultParams('purge_message', filledEvidence)).toEqual({
+      messageId: 'message-123',
+      mailboxes: [],
+    });
+  });
+
+  it('returns userPrincipalName (from requesterEmail) for reset_password', () => {
+    expect(deriveDefaultParams('reset_password', filledEvidence)).toEqual({
+      userPrincipalName: 'requester@wulfconsulting.test',
+    });
+  });
+
+  it('returns empty deviceId for isolate_endpoint', () => {
+    expect(deriveDefaultParams('isolate_endpoint', filledEvidence)).toEqual({ deviceId: '' });
+  });
+
+  it('returns userPrincipalName + empty ruleName for disable_forwarding_rule', () => {
+    expect(deriveDefaultParams('disable_forwarding_rule', filledEvidence)).toEqual({
+      userPrincipalName: 'requester@wulfconsulting.test',
+      ruleName: '',
+    });
+  });
+
+  it('returns {} for an unknown/future action type', () => {
+    expect(deriveDefaultParams('unknown_future_type', filledEvidence)).toEqual({});
+  });
+
+  it('falls back to empty-string defaults for warn_user/block_sender/reset_password/disable_forwarding_rule when evidence fields are null', () => {
+    expect(deriveDefaultParams('warn_user', emptyEvidence)).toEqual({ recipientEmail: '', message: '' });
+    expect(deriveDefaultParams('block_sender', emptyEvidence)).toEqual({ senderEmail: '', senderDomain: '' });
+    expect(deriveDefaultParams('purge_message', emptyEvidence)).toEqual({ messageId: '', mailboxes: [] });
+    expect(deriveDefaultParams('reset_password', emptyEvidence)).toEqual({ userPrincipalName: '' });
+    expect(deriveDefaultParams('disable_forwarding_rule', emptyEvidence)).toEqual({
+      userPrincipalName: '',
+      ruleName: '',
+    });
+  });
+});