---
title: "Test on a copy of the system · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/test-a-copy
updated: 2026-10-20
licence: "All rights reserved"
---

# Test on a copy of the system

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)
- Rule: Run attacks against a staging copy with fake data. Touch production only for read-only checks the owner has approved.
- How: Build staging as [keep a staging copy with fake data](https://agentwranglers.se/playbook/testing/test-data-and-environments/production-like-staging) says, from the same code and settings as production. Fill it with made-up customers and test accounts. Give it its own keys, so a leaked key from the test is worthless elsewhere.
- Check: Staging and production return the same version number. A search of the staging database finds no email address outside the test domain, such as `@example.com`.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/test-a-copy`.

- Previous: [Get written permission first](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/written-permission)
- Next: [Do no harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/do-no-harm)
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)