Always-on reconnaissance and testing against a client's approved asset inventory — no scan windows, no re-scoping per engagement.

Governed by: standing authorization scoped to a defined asset list, revocable at any time, every scan logged.

Attack chains that evolve across engagements as the agent learns what worked, rather than running the same static playbook every time.

Governed by: every reasoning update reviewed against a baseline before deployment — no unreviewed behavior change ships to a live engagement.

Beyond “here's the report” — propose a fix, apply it in a staging or CI environment, re-test, confirm closure.

Governed by: write access limited to non-production environments unless explicitly granted; every change tied to a signed authorization record.

When the agent finds evidence a vulnerability extends into adjacent, client-owned systems, it can propose — not act on — expanding scope.

Governed by: scope changes require a new signed authorization token before any action; discovery and action are always separated.

Where PoC alone understates real business risk, demonstrate true impact inside an environment built for it — not production.

Governed by: sandbox-only, contractually pre-approved, fully reversible.