Confirming Pentest Authorization

Overview

Penetration testing is computer access. Without explicit authorization from the owner of the system under test, that access is a crime — Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK, equivalent laws everywhere else. The line between an authorized pentester and an unauthorized attacker is one signature on one document.

The penetration-tester pack's other skills (TLS analysis, CORS audit, dependency CVE scan, etc.) all assume that line has been crossed correctly. This skill is the first gate the orchestrator routes to. It refuses to declare an engagement authorized until a Rules of Engagement (ROE) attestation file exists, is signed, and contains the fields any real-world legal review will look for.

This is not paranoia or paperwork theater. Engagements DO go sideways: scope creeps mid-test, a tester probes an out-of-scope adjacent system, an SOC team escalates a "real" attack to legal, and the question "show us the ROE" comes up. If the ROE is in order, the answer is "here it is." If not, the conversation gets expensive fast.

When the skill produces findings

Finding	Severity	Threshold	Affected control
ROE file missing	CRITICAL	No attestation file at the expected path	(legal)
Required field missing	CRITICAL	authorizer, in_scope_targets, time_window, emergency_contact, or signature absent	(legal)
Signature missing	CRITICAL	No signature_block in ROE	(legal)
Signer not in allowlist	CRITICAL	signer email/key id not in .allowed-authorizers	(legal)
Time window expired