The most advanced guardrails for autonomous offense.
You set the balance of power and safety.
AARM governs what our agents are permitted to do at runtime. You dial how deep the adversary goes and how much it is allowed to touch, per engagement, from a disposable staging box to your production core. Some actions you choose by scope. A short list is never on the table, at any level, by anyone.
The level of enforcement is your decision,not ours.
A guardrail that stops an agent from taking an irreversible action also, sometimes, stops it from producing the definitive proof that the action was possible. That trade is real, and it is not ours to make on your behalf. It is yours, per engagement, because the right posture for a staging box is not the right posture for a production banking platform.
The line we draw at runtime was never dangerous versus safe. It is: does this action prove the finding, or does it cause the harm?
Match the level to the environment
Three profiles move the dial in one place, in the engagement launch flow. Higher levels surface deeper findings and allow more intrusive actions. Lower levels trade coverage for containment.
Recorded against the engagement
The posture you pick is a deliberate decision, logged against the campaign and auditable later. Scoped, approved, and under your control is the default, not a setting you have to go find.
No posture is unconstrained
There is no configuration of SpartanX in which an agent runs free. Deterministic scope enforcement and the hard safety limits hold at every level, including the deepest one.
Choose what the agents may do.A short list they never may.
AARM governs what the agents are permitted to do at runtime. Higher levels surface deeper findings but allow more intrusive actions, so match the level to the environment. The bottom two behaviors are hard safety limits. They are always blocked, at every level, by anyone.
| Compare | Guarded Minimum impact | Balanced Medium coverage and impact | Unrestricted Deepest coverage |
|---|---|---|---|
| Use case / Environment | Highly sensitive production | Production | Development, Testing, Staging |
| In-scope, deterministic enforcement | Always enforced | Always enforced | Always enforced |
| Deterministic filter | Enforced | Not used | Not used |
| Dynamic Action Runtime filters | Enforced | Enforced | Not used |
| Changes its own test data | Blocked | Allowed | Allowed |
| Changes other users' data | Blocked | Blocked | Allowed |
| Triggers business side effects | Blocked | Blocked | Allowed |
| Creates files or resources on the server | Blocked | Blocked | Allowed |
| May establish a persistent foothold | Blocked | Blocked | Allowed |
| Verifies found credentials | Blocked | Allowed | Allowed |
| Deliberately cause denial of service | Always blocked | Always blocked | Always blocked |
| Destroys or corrupts system data & infrastructure | Always blocked | Always blocked | Always blocked |
| Exploitation accuracy & timing impact | High impact | Medium impact | Zero impact |
Guarded adds a deterministic, non-reasoning filter in front of the agents for the most sensitive estates. Balanced keeps dynamic runtime evaluation without the network gate. Unrestricted removes the runtime brakes so the adversary goes as deep as a real one would, which is why it is meant for environments you can afford to let it work in.
Two things are never on the dial.
These are not settings. No scope, no severity of finding, and no instruction buys permission to cross them. They are blocked for every agent, in every engagement, at every level.
Deliberately cause denial of service
No agent may stop, kill, restart, disable, or exhaust a service, process, or resource to prove a point. Availability is never the thing we break to show it could break.
Destroy or corrupt system data and infrastructure
No deleting, dropping, truncating, encrypting, or overwriting data, tables, buckets, accounts, or resources. Exploitability is confirmed with the least invasive method that proves it, then the agent stops.
Scope enforcement never turns off
In-scope, deterministic enforcement holds at every level. Only the targets you authorized are ever evaluated. Reaching the deepest profile does not widen the scope by a single asset.
SAFE Checks override every task step
The always-in-force rules of engagement sit above the mission. Any step that would require a destructive or irreversible action is overridden before it runs, regardless of the finding it would confirm.
Ambiguity resolves to no
Where an action cannot be confidently classified as safe, the system does not queue it for review and does not take it. SpartanX runs without a human in the execution loop, so uncertainty stops, it never waits.
Steer the platform before it starts.Including your own safe restrictions.
Knowledge is what the agents read before they run. It is where you tell the platform how to behave on your estate: what to prioritize, how to reach the targets you care about, and where to hold back. System entries are on by default and can be taken off per campaign, and you can add your own.
Point the adversary
Give the agents what a real tester would be handed on day one: specific CVEs the assessment must not miss, a provided OTP seed and login flow so it can get past MFA the way an authorized account would, or a tightly drawn identity-only scope that keeps the whole campaign on your IdP and sign-in path.
Pull it back
The same control narrows the adversary. Forbid lateral movement on every asset. Keep the work surface-level instead of an exhaustive exploitation chain. Layer in restrictions of your own in plain language. Knowledge steers in both directions, wider or safer, and it is yours to set.
SAFE Checks
Non-destructive rules of engagement for every agent and action. Confirm findings without causing harm, validate with the least invasive method that proves the point, then stop. Overrides any task step that would require a destructive or irreversible action.
No lateral movement
If the agent gains a foothold, it does not use it to reach or compromise any other host or system. A reachable neighbor is noted as a finding, not followed.
Surface-level vulnerability analysis
Identify and report observable weaknesses from normal interaction with the target. Favor breadth and clarity over depth: confirm a weakness is real, then move on, no exhaustive exploitation.
Specific CVEs to check
A list of known CVEs the assessment must not miss. The agent checks the exposed product and version against each, in addition to its normal work, never as a limit on it.
OTP seed and IdP login
A provided TOTP seed and the real browser sign-in flow, so the agent authenticates the test account the way its own authenticator app would. No guessing, brute force, or replay.
Identity-only scope
Scope the whole campaign to the enterprise identity provider and the sign-in flow around it, end to end, instead of a general web or API assessment.
One control that stops everything.Immediately, and without argument.
The dial decides how the adversary runs. The kill switch decides that it stops. One action in the platform ends the campaign outright. It is deterministic, and no agent can refuse it, defer it, or reason its way around it.
- Complete cancellation. The engagement is terminated, not paused. Every running agent is halted in place.
- Sandbox access revoked. Access to the execution sandboxes is cut immediately, so nothing in flight can continue to act.
- All agent activity killed. The coordinated system of agents goes quiet at once, across every attack surface in the campaign.
- Yours to pull, any time. No ticket, no window, no waiting on us. The stop is in your hands for the length of every engagement.
Autonomy you trust,because you set the limits.
Walk through the dial, the hard limits, and the kill switch against your own environment, and decide where the line sits before a single agent runs.