Scope and Guardrails

​

What Scope Controls

• primary domains and application URLs
• additional allowed domains or routes that are part of the same target
• in-scope systems agents should include
• out-of-scope systems agents should exclude
• important tenant, workspace, account, or environment values
• authentication context and credential role boundaries

​

Common Scope Patterns

​

Guardrail Types

• Rate Limiting controls agent request pacing with Auto, Aggressive, Reduced, and Extreme Stealth modes.
• Scope stores Include and Exclude entries for domains, IPs, CIDRs, routes, or other testing boundaries.
• Rules store additional constraints for agent behavior.
• Custom Values store target-specific context agents should know while testing.

​

Configure Scope

1. Open Target Inventory.
2. Select the target.
3. Open the Guardrails tab.
4. Set Rate Limiting if the default automatic pacing is not appropriate.
5. Add Include entries for systems that agents should test.
6. Add Exclude entries for systems that agents must avoid.
7. Add Rules for behavior constraints such as avoiding destructive actions.
8. Add Custom Values for context such as tenant_slug, workspace_id, organization_id, or environment.
9. Save changes before starting an assessment or Agent.

​

Examples

​

Tenant-Aware SaaS App

Target: https://app.example.com
Login route: https://app.example.com/login
Tenant slug: acme-security
Include: /dashboard, /settings, /api
Exclude: /billing, /admin/delete-account
Rule: Do not trigger production emails or payment flows.

​

Multi-Domain Login Flow

Target: https://app.example.com
Login starts at: https://login.example.com
Include domains: app.example.com, login.example.com
Expected post-login page: https://app.example.com/dashboard

​

Before Launch

• the target is verified
• stored credentials are dedicated test accounts
• login instructions include every redirect and required intermediate step
• include and exclude entries are current
• behavior rules cover sensitive workflows
• WAF allowlisting is complete if your infrastructure filters automated traffic