A county team rejects an agentic offensive agent that would be allowed to install payloads on unmanaged library kiosk PCs. What scoping decision is correct?

County teams that reject an agentic offensive agent allowed to install payloads on unmanaged library kiosk PCs are correctly scoping away from uncontrolled civic endpoints. Unmanaged kiosks often lack inventory accuracy, EDR coverage, patch discipline, and clear custodianship; citizens may be actively using them. Payload installs there create real-world harm risk and undermine the legitimacy of authorized purple work.

The correct scoping decision works by requiring managed, approved ranges for agentic payload actions. Controlled lab or managed assets provide monitoring, rollback, and consent boundaries that public kiosks do not.

Scoping agentic offensive agents away from unmanaged library kiosks with session reset between patrons fails because it limits exclusion to only that subset, implying installs on other unmanaged kiosks would be acceptable, when session resets do not provide inventory accuracy, EDR coverage, or custodianship and the correct scope excludes unmanaged civic endpoints entirely.

Scoping agentic offensive agents away from unmanaged library kiosks during overnight windows with staff approval fails because it limits exclusion to a time window, implying installs on unmanaged kiosks at other times would be acceptable, when the correct scope excludes unmanaged civic endpoints entirely.

Scoping agentic offensive agents away from unmanaged library kiosks with signed binaries and rollback snapshots fails because it conditions exclusion on payload hygiene and recoverability rather than endpoint control, implying other unmanaged kiosk installs would be acceptable, and signed binaries and snapshots do not make unmanaged civic endpoints safe targets.

Exam caveat: Scope agentic offense to controlled assets; unmanaged library kiosks are a classic “do not” target class.

Operational check: Maintain an allowlisted target inventory for agentic installs, auto-deny unmanaged/kiosk OUs, and require documented authorization exceptions with compensating monitoring.