Scope and consent

This page shows you how to tell ATLAS what it may examine for an organisation, and how to give it permission to do so. You add domains, IP addresses and ranges, prove that the organisation owns them, record the signed scanning mandate and, only when an engagement calls for it, authorise intrusive testing.

All of this lives on one page: Settings › Scope & consent. Its heading reads "What Soveryne may look at for <organisation>, and how."

Who can do what

How the three conditions work

ATLAS sends nothing to an organisation's systems until three conditions hold:

Passive reconnaissance is different. It reads public records such as certificate transparency logs, DNS and domain registries, and sends nothing to the organisation. It needs only a domain in scope, verified or not.

The Scans page shows the state of every condition at a glance. See Scans.

Add a domain, IP address or range

Anyone with the admin or user role can add scope items.

ATLAS confirms: "<item> added to scope. Verify ownership before scanning it." The item appears in the list with the status Unverified.

The list shows domains first, then addresses, then ranges. Each row shows:

Prove ownership of a domain

Before ATLAS scans anything under a domain, the organisation must prove it controls that domain. The usual proof is a DNS TXT record.

When ATLAS finds the record, it confirms "<domain> verified." and the row reads Verified by DNS.

If it does not find the record, it says "<domain> is not proved yet. What to publish is shown under it in Scope & consent." Below the row it notes: "Last checked <time> ago: not proved yet. No matching TXT record was found on <domain>. DNS changes can take a few minutes to become visible." The button now reads Check again. Wait a few minutes and choose it.

Verify a domain with a launch code

A launch code is another way to verify a domain. An administrator generates a code for one domain and gives it to the person who works on that organisation, who enters it. A code works for one domain only, expires after 15 minutes and works once. It proves ownership of the domain; it does not replace the mandate.

To generate a code (admin only):

To use a code (admin or user):

ATLAS confirms "<domain> verified by launch code." and the row reads Verified by launch code.

Launch codes work for domains only, not for IP addresses or ranges.

Prove ownership of an IP address

An address has no DNS zone of its own, so ATLAS accepts any one of several proofs. Set up whichever your network allows, then choose Verify. ATLAS tries every proof each time.

After a check, each proof shows what it found last time: a tick with the evidence when it passed, "✗ Last check: …" when it did not, or "Not tried last time: …" when it was skipped.

Prove ownership of a range

A range can be proved in either of two ways:

Then choose Verify. An address inside a verified range is covered too; its status reads Inside a verified range.

Record an attestation

When ownership cannot be proved through DNS, an ATLAS administrator can record an attestation instead. It states where the authorisation is written down, such as the signed scope document of the engagement.

ATLAS confirms "<domain> attested." and the row reads Attested by followed by your name. The posture report shows who attested each item.

Record the scanning mandate

The mandate is the organisation's written permission for active reconnaissance: port scans, service identification and similar checks that send network traffic to its systems. Passive reconnaissance and vulnerability lookups never touch the organisation's systems and need no mandate.

Anyone with the admin or user role can record the mandate.

ATLAS confirms "Mandate recorded for <organisation>." The section now reads "Signed by <name> on <date>."

Without a mandate, the section reads "Not authorised — active recon jobs will be refused. Enter the signatory and tick the box to record a mandate." If you tick the box without a signatory, ATLAS says "Enter the signatory before recording a mandate."

To withdraw the mandate, untick Active reconnaissance is authorised. ATLAS confirms "Mandate withdrawn. Active reconnaissance will be refused." Scans that would send traffic are refused from then on; passive reconnaissance still runs.

The mandate has no expiry date. Withdraw it when the engagement ends.

Authorise intrusive testing

The mandate says that network traffic may reach the organisation's systems. It does not say that anyone may attempt a login, or change what the organisation's visitors are served. Those need a second authorisation: signed, limited to at most 90 days, and naming the hosts it covers. Nothing intrusive runs without it.

Only people with the admin role can record or withdraw this authorisation.

ATLAS confirms "Intrusive testing authorised for <organisation> over <number> hosts, until <date>." The status reads Authorised, with who authorised it, until when, how many days are left, who accepted the lockout risk, and Hosts it covers.

ATLAS checks the form before saving:

When the end date passes, the status reads Expired: "Expired on <date>. Intrusive stages are refused until a new authorisation is recorded." To end it sooner, choose Withdraw authorisation.

Without an authorisation the status reads Not authorised: "Not authorised. Stages that attempt a login are refused, which is the default and the safe state."

Other details on the page

At the bottom of the page you see:

Private addresses

By default ATLAS scans only addresses that are reachable on the public internet. For an internal engagement, Soveryne can allow private addresses for one organisation. The Private targets cell on the Scans page shows the current decision.

Troubleshooting