Nothing happens without paperwork.
Before a single agent touches a target, we agree and sign a scope: which domains, apps, and accounts are fair game; what's explicitly out of bounds; testing windows; and who gets paged if something looks wrong. You'll prove control of in-scope assets — we don't take anyone's word, including yours.
The ROE is a living document. Expand it, shrink it, or suspend it mid-engagement — changes take effect within minutes, swarm-wide.
What the swarm will and won't do.
Always on:
- Rate limits honored per asset — probes pace themselves like a cautious human, not a scanner
- Out-of-scope assets hard-blocked at the agent layer, not just filtered in reporting
- Destructive actions disabled class-wide: no writes to production data, no persistence, no ransomware simulation without explicit opt-in
- Every agent action logged and attributable
Requires explicit opt-in:
- Social engineering and phishing simulations
- Physical-adjacent testing (badge systems, wireless)
- Data exfiltration demonstrations — we prove reach with canary records, never bulk real data, unless you ask
- Denial-of-service class testing (rarely; usually a loud "yes, reachable" is proof enough)
Fifteen minutes, any hour.
Every engagement includes a 24/7 operations channel. One message — "stop" — and all agent activity against your estate halts within fifteen minutes. A human operator confirms, and the pause holds until you say otherwise. Test it on day one; clients do.
# engagement control channel ops#1847> stop [00:01:12] swarm halt acknowledged — 14 agents parked [00:04:30] operator elias confirms: all quiet.
Evidence, minimized.
Findings carry the minimum evidence needed to prove the path — request/response captures, canary records, access demonstrations — encrypted in transit and at rest, access-logged, and purged on a schedule you choose at engagement end. We don't train shared models on your estate's data. Your telemetry improves your swarm profile only.
Our own house: see responsible disclosure and privacy. Found something? security.txt.