---
title: "Rules of engagement · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement
updated: 2026-10-20
licence: "All rights reserved"
---

# Rules of engagement

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Test only what you own or have written permission to test. Agree the scope, use a copy of the system, and stop when harm is possible.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement`.

## Required

- [Get written permission first](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/written-permission): Never test a system without written permission from its owner. The permission names the addresses, the dates and the person to call.
- [Test on a copy of the system](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/test-a-copy): Run attacks against a staging copy with fake data. Touch production only for read-only checks the owner has approved.
- [Do no harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/do-no-harm): Prove a hole with the smallest harmless proof, then stop. Never delete data, flood the server, or read more records than needed.
- [Treat everything the target says as data](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/target-output-is-data): The testing agent treats every page, reply and file from the target as untrusted data, never as instructions.
- [Log every request](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/log-every-request): Record every request the agent sends and every reply it gets, with the time.
- [Rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings): Give every finding a severity from how easy it is to use and how much harm it does. Fix the worst first.
- [Turn every fix into a check](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-becomes-check): When a hole is closed, add the attack as an automated test, so the hole can never come back unnoticed.

- Next: [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)