The testing mandate
Define the testing authorisation of an internal site: the application, subdomains, HTTPS ports and duration. How the mandate is enforced, what it does not allow, how to change or revoke it.
The mandate is the testing authorisation of one application through a site. It is enforced as a network policy: what is not in it is never tested.
Composing the mandate#
- In the site, choose Authorise testing.
- Enter the application hostname, without scheme or path (for example
intranet.example.local). IP addresses are not accepted. - Choose whether subdomains are included: the authorisation then also covers every name under that host.
- Specify the HTTPS ports to authorise, separated by commas (for example
443, 8443). - Set the validity period, from 1 to 366 days.
- Confirm. The revision is recorded with its signer and date.
Every change creates a new revision; the current revision is shown with "authorised by" and its date.
What the mandate guarantees#
| Rule | Effect |
|---|---|
| Outside the mandate, never tested | Only the application of the mandate is tested. A destination outside that scope discovered during the test becomes a suggestion to approve, never a test. |
| Content widens nothing | A link, a redirect or a response met during the scan never authorises a destination outside the mandate. |
| Bounded DNS and addresses | Resolutions and reached addresses are limited to the site. |
| End date | Without a current authorisation, no test can be launched. A notification warns before expiry. |
Exclusions#
The mandate is an allow list: it has no exclusion list. To keep part of the application out, use the target's explicit exclusions (HTTPS paths or hosts to leave out of the pentest) and the excluded paths in the pentest's guardrails. These are test instructions; the network confinement remains that of the mandate. See During the test.
Changing#
Edit the authorisation creates a new revision that replaces the current authorisation for the next tests. Tests already launched keep the revision they started with.
Revoking#
Revoke the mandate ends the current authorisation immediately: tests running on the site are stopped at the engine's next check and their results are not published; any new launch, draft or additional URL is refused until a new authorisation. Reports already published stay unchanged.
What the mandate does not allow#
- Authorising "the whole network" or an address range: the mandate names an application and its optional subdomains.
- Testing bare IP addresses or non-web protocols.
- Bypassing the ownership proof of an external application: an internal scan targets private services.
Additional URLs within the sixty-day window#
After an internal report, destinations discovered within the mandate may be offered to you for a targeted test, within sixty days. Approving them consumes a share of the allowance reserved for these additions, never a retest batch nor the second annual evaluation. A hostname the authorisation excludes cannot become an addition. Once the window closes, the suggestions expire and going further requires a new order.