Provaex — Rules of Engagement

This document is completed and countersigned before any test prompt is

sent to a client's system. A reply confirming the details below, from

an authorized contact at the client organization, is the minimum

accepted form; a signed copy is preferred for engagements above the

one-time audit tier.

1. Scope

• Target(s): [exact URL(s) / API endpoint(s) to be tested]
• Environment: [ ] Production   [ ] Staging (select one per target)
• Ownership verification: confirmed via [ ] DNS TXT record   [ ] /.well-known/provaex-verify.txt, matched on [date]

2. What is tested

• EU AI Act Article 50 transparency disclosure (EU-01)
• System-prompt / instruction extraction resistance (SEC-01)
• Multi-step reasoning and instruction-following (LOGIC-01)
• Business-logic / authorization-bypass resistance (POLICY-01) — staging targets only, never enabled for production

3. What is explicitly out of scope

• Any target not listed in Section 1
• Any attempt to access data belonging to the client's end users
• Denial-of-service or high-volume load testing
• Business-logic tests (Section 2, POLICY-01) against a production environment, under any circumstance, even at the client's request — this clause is not waivable, since the failure mode it prevents (a real, executed transaction) can't be undone by consent after the fact

4. Duration & timing

Testing occurs within [X business days] of verification clearing.

Total request volume: approximately 50 prompts per endpoint per run,

sent at a rate that will not meaningfully affect target availability.

5. Confidentiality

Raw outputs, screenshots, and the resulting report are shared only

with the signing organization, retained for [X days/months], and

deleted on request. Provaex does not use client-specific test

outputs for marketing without separate written permission.

6. Point of contact

Client authorized contact: ______________________

Provaex contact: Lokesh Nandre — lokesh@provaex.com

7. Signature

By replying "confirmed" to this document from the authorized contact's

email, or by countersigning below, the client confirms authorization

to test the target(s) listed in Section 1 under the terms above.

Client signature: ______________________   Date: __________