How Hostile Content in Scope Is Contained

Your agents read what the target gives them: pages, responses, tool output, banners. Any of it can carry text written to redirect an agent, and it arrives inside a session that legitimately holds engagement context. No amount of isolation between firms helps here, because the instruction is not coming from another firm. It is coming from the system under test.

So the controls sit around what an agent is allowed to do, not around who it is talking to. Sensitive actions do not execute on the agent's own judgement, tool access is scoped to the engagement, and a human approves anything that leaves a mark on a client system.

The controls

• Credential handling and destructive actions require explicit operator approval before they run.
• Tool access is gated to the engagement's scope, so an agent cannot reach for capability it was not authorised to use.
• Command logs and session transcripts are redacted, so a manipulated command does not persist secrets into your records.
• Every finding and every report section is reviewed and approved by your operators before a client sees it.
• Agent sessions are recorded and attributable, so anything unexpected is reconstructable after the fact.