CYBRARY Written authorization first
A document can inform scope, but importing it never authorizes testing. A reviewer approves the structured scope.
Forge Anvil · Safety
Authorization and scope enforcement
The controls that separate a permitted assessment from an unrestricted toolset, plus the limits teams must understand.
Checks before every run
The broker resolves the target and checks addresses, ports, actions and the testing window before a qualified tool starts.
Sealed network option
On Linux and Windows WSL, the sealed edition limits tool traffic at the operating-system network layer and records blocked attempts.
Human approval remains
AI can propose and explain. It cannot approve new testing, expand scope or silently execute a command.
Immediate stop and revocation
Emergency Stop halts controlled execution. Device revocation is checked on the next operation.
Honest boundaries
Expert mode offers broader tool choice with limited enforcement, and tools outside Anvil are beyond its control.
Fresh scope when leaving a lab
A simulated lab never hands its targets, credentials or permission into a real assessment. Starting real execution requires a separately authorized engagement.