Engagement Scope Authorization Agent

Before any security testing, every target must be covered by a signed authorization, or the work is illegal, and client target lists are often messy. This agent reads the signed authorization and the client's target list, resolves each domain to its address and checks address ownership records. It compares each target with the signed scope. It flags targets not in scope, addresses that belong to a third party such as a cloud or shared hosting provider, and anything whose ownership it cannot confirm. Each unclear target is held, and the agent drafts a question to the client. Nothing held is passed to testing tools. It assembles the approved target list with the authorization record. You approve the final list. Edge case: a domain that now resolves to a different provider than when the authorization was signed is held for re-confirmation.