---
title: "Get written permission first · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/written-permission
updated: 2026-10-20
licence: "All rights reserved"
---

# Get written permission first

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)
- Rule: Never test a system without written permission from its owner. The permission names the addresses, the dates and the person to call.
- How: Write a short scope file before the test starts. List the addresses in scope and the ones out of scope. Add the test window, the allowed methods and a contact who can stop the test. Testing without permission can be a crime, even with good intent. Read your hosting provider's testing policy too. Most allow tests of your own systems but forbid floods.
- Check: The agent reads the scope file before its first request. Ask it to request one address from `out_of_scope` and one that is not listed. It refuses both and logs the refusal.

Example:

```yaml
# scope.yaml
owner: Example Shop Ltd
contact: security@example.com
window: 2026-11-02T09:00Z/2026-11-02T17:00Z
in_scope:
  - https://staging.example.com
  - https://api.staging.example.com
out_of_scope:
  - https://example.com
  - payment provider, email provider, any third party
allowed: [read, write test data, automated scans under 5 requests per second]
forbidden: [denial of service, social engineering, customer data from production]
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/written-permission`.

- Next: [Test on a copy of the system](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/test-a-copy)
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)