Authorization model

Scope is the boundary

A scope is the place where you define what may be tested. Runs, credentials, mapped repositories, assets, findings, automations, and reports all attach to a scope.

Target rules

• Public domains should be verified before active testing.
• Public CIDRs may require review before testing.
• Private CIDRs are for private runner execution and do not use internet ownership proof.
• Targets outside the active scope should not be included in assessment goals.

Rules of engagement

Rules of engagement tell the agent what matters, what to avoid, and how much impact is acceptable. They should include rate limits, testing windows, exclusions, forbidden techniques, and escalation contacts.