Security & scope

Monkeys prefer preview and staging targets. Production hosts still get Explore and Interact findings; write and Adversarial packs stay off. Domain verification (TXT / DNS) is required before a run can start. That is how aggressive testing stays safe.

What monkeys may do

• Navigate pages, exercise forms, and follow Interact briefs on verified hosts
• Capture screenshots and structured findings for George's report
• On Adversarial (request access): structured adversarial suites, not random chaos

Guardrails

• Production targets get Explore and Interact findings; write/Adversarial packs stay off
• Rate limits and per-run time / AI budget caps
• Exact-tier tokens: no cross-tier burn

How verification works · Enterprise & air-gapped · Signed agent policy