Skip to main content
By default, the agent decides on its own what is safe to do during a pentest. If you want a person to approve sensitive actions first, turn on human approval. When a sub-agent reaches a sensitive action, it pauses and sends an approval request to the Agent Hub. Other sub-agents keep running while it waits.

​
Turn it on for an application

1

Open the Pentest mode step

In the Add application wizard, go to the Pentest mode step. For an existing application, click Configure and open Pentest mode.
2

Turn on the switch

Turn on Require human approval for sensitive actions.
3

Set the interaction timeout

Under Interaction timeout, choose how many hours the agent waits for an answer. You can pick from 1 to 6 hours. The default is 4 hours. If nobody answers in time, the request is rejected automatically.
4

Write your rules (optional)

In the text box, describe when the agent should stop and ask. Keep the list short. Too many rules cause many interruptions and make the scan slower. You can use up to 2,000 characters. If you leave it empty, the agent uses its default safe-mode rules.
Example rules:
  • Ask before any payload that writes, updates, or deletes data.
  • Ask before testing any authenticated endpoint.
  • Pause and ask before brute-forcing credentials.
  • Request approval before submitting any form on the site.

​
Change it for one scan

When you click Run pentest, the Start a one-time pentest dialog has the same settings. Changes there apply only to that scan. The application settings stay the same.

​
If the switch is locked

If you see a Locked badge next to the switch, human approval is not available for your organization yet. Contact us to turn it on.

​
Good to know

  • Approval requests can make a scan take longer, because part of the work waits for you.
  • Turn on Slack notifications so your team sees requests quickly.
  • Human approval does not replace scope. Out-of-scope URLs and blocked endpoints are always respected.