The short version
Only test systems you own or have explicit written authorization to test. Running these tools against systems without permission can violate computer fraud, wiretap, and anti-hacking laws in most jurisdictions, regardless of intent. You are solely responsible for how you use Legion.
Scope and rules of engagement
When you create a task in Legion, you set a scope. This is the IP address, IP range, or domain that is in bounds for the task. The scope appears on your report and the AI Operator uses it to stay inside the agreed target.
Be as specific as your authorization allows. If your written authorization covers only a single host, scope the task to that host. If it covers a subnet, use the subnet. Do not set a broad scope to cover targets you were not explicitly authorized to test.
If you are working on a formal engagement, the rules of engagement document from your client should define exactly what is in scope, what testing methods are allowed, the testing window, and who to contact if something goes wrong. Keep that document accessible while you work.
Authorization checklist
Before starting a task, confirm all of the following:
- You own the target system, or you have a signed written authorization document from the system owner.
- The authorization covers the specific IP addresses, domains, and systems you intend to test.
- The authorization covers the testing methods you plan to use (scanning, exploitation, wireless capture, etc.).
- You are testing within the agreed time window, if one was specified.
- You know who to contact immediately if you accidentally access an out-of-scope system or cause unintended impact.
- You understand the relevant laws in your jurisdiction and the jurisdiction where the target operates.
Command approvals and guardrails
When the AI Operator is running a task, you can require it to pause and ask for your approval before executing each command. This keeps you in the loop on every step and prevents the agent from running something you didn't expect.
To enable this, turn on command approvals in the Agent tab before you start the task. When approval mode is on, the agent will show you the exact command it intends to run and wait for you to approve or reject it before continuing.
You can also set the stealth level using the dropdown in the top right of the app. Lower stealth levels produce less network noise and are less likely to trigger IDS or alerting. If your rules of engagement require low-impact testing, set the stealth level accordingly before running the agent.
If the agent runs a command and hits something unexpected, stop the task immediately and review the Activity tab to see exactly what was run and what it touched.