Agent WranglersRules of engagement Required
Get written permission first
Never test a system without written permission from its owner. The permission names the addresses, the dates and the person to call.
How to do it
Write a short scope file before the test starts. List the addresses in scope and the ones out of scope. Add the test window, the allowed methods and a contact who can stop the test. Testing without permission can be a crime, even with good intent. Read your hosting provider's testing policy too. Most allow tests of your own systems but forbid floods.
Example
# scope.yaml
owner: Example Shop Ltd
contact: security@example.com
window: 2026-11-02T09:00Z/2026-11-02T17:00Z
in_scope:
- https://staging.example.com
- https://api.staging.example.com
out_of_scope:
- https://example.com
- payment provider, email provider, any third party
allowed: [read, write test data, automated scans under 5 requests per second]
forbidden: [denial of service, social engineering, customer data from production]How to check
The agent reads the scope file before its first request. Ask it to request one address from out_of_scope and one that is not listed. It refuses both and logs the refusal.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/written-permission.