What our agents may do on your systems, in writing, before they start.
Borrowed from penetration-testing practice: nothing runs until an authorised person signs a Test Authorization that sets scope, actions, windows and a stop protocol. This is the template.
Three permission levels. You choose per property.
Look, don’t touch
Agents read pages and navigate, but never submit a form. Default for third-party embeds (SSO, payment iframes, chat).
Complete the funnel, stop before pay
Agents fill forms and move through checkout, booking or quote flows with synthetic data, then stop at the payment step.
Irreversible steps, sandbox only
Submitting orders or applications, only in a sandbox with test cards, and only with an Approver’s signature.
The exhibit, clause by clause.
1. Authorised scope
Properties (origins), environments (production read-only, staging, preview) and test accounts in scope. Anything not listed is out of scope.
2. Permitted actions
A matrix of property × environment × mode (Observe / Act / Commit). Commit requires sandbox detection and an Approver signature.
3. Windows and blackouts
Allowed hours and days; blackout periods such as code freezes, peak sales events and incident windows.
4. Rate limits
Default ≤ 2 concurrent sessions per origin; 429 and Retry-After are honoured automatically; machine-paced load only on explicitly authorised properties.
5. Identity
All requests carry alt.qa’s Web Bot Auth signature, X-Alt-Test: true and a documented user agent. We never impersonate a consumer agent or person. Allow-listing guidance: WAF allow-listing.
6. Notifications
Named contacts on both sides; cloud-provider or CDN notification where their terms require it.
7. Stop protocol
Either party can stop all runs instantly via the kill switch, email or phone. alt.qa stops automatically on unexpected state changes, error spikes or a Retry-After storm.
8. Data classification and retention
Synthetic data only in forms; recordings retained per workspace setting (default 90 days, zero-retention available); evidence encrypted per workspace.
9. Payments
No live payments ever. See the payments testing policy.
10. Signature
Signed by the authorising person with role, date and expiry. Immutable once signed and linked from every job and cell.
The Ninth Circuit’s 4 Aug 2026 decision in Amazon v. Perplexity protects user-directed agents running on a user’s machine; cloud agents acting without the site owner’s consent are a different fact pattern. That is why full-funnel runs happen only on properties you authorise, and our public benchmark is read-only.