You won’t be executing the qvm-foo or qubes-bar command in dom0 though, but it in the admin client qube. Then the command will make (often multiple) admin API calls to dom0.
So as a starting point you could simply try running the command in the qube while watching the dom0 journal. It should log a qrexec call getting rejected because there’s no policy allowing it yet.