Who can grant it
The person who signs is entitled to permit testing of the named systems.
What the document covers
Named targets. A time window. Objectives. Methods that are out of bounds. What to do if something breaks, or if real attacker activity is found. Who to call.
Third-party systems are in scope when that third party has authorised the work in writing.
