Security & scope

Monkeys prefer preview and staging targets. Production hosts still get browse and specialist findings; write and disruptor packs stay off. Domain verification (TXT / DNS) is required before a run can start — that is how aggressive testing stays safe.

What monkeys may do

• Navigate pages, exercise forms, and follow Specialist briefs on verified hosts
• Capture screenshots and structured findings for George's report
• On Disruptor (request access): structured adversarial suites — not random chaos

Guardrails

• Production targets get specialist findings; write/disruptor packs stay off
• Rate limits and per-run time / AI budget caps
• Exact-tier tokens — no cross-tier burn

How verification works · Enterprise & air-gapped · Signed agent policy