Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026
Campaign and individual-target permissions
Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity.
| Example target | Allowed | Denied / not authorised |
|---|---|---|
| X, Y, Z | Specified email simulation during the approved window | Telephone, SMS and other destinations unless separately approved |
| A, B, C, D, E | No staff contact | All contact simulation channels |
| A physical site | Only the exact approved site/method/window, if any | Building intrusion when the client prohibits it |
Permission is the intersection of client, campaign and individual target rules. The risk label is an additional ceiling, never a substitute for explicit method and person approval. Check current policy both before dispatch and immediately before an external effect. Revocation stops future actions; it cannot unsend a message.
Library instructions alone cannot enforce this. HILLY, native agents, telecoms, account provisioning and manual handoffs must all use the same authoritative boundary. That live enforcement is not implemented by this documentation publication.
Offline example checks
28 synthetic decision checks passed; this is a design demonstration, not a live-agent test.
| Case | Expected | Result reason |
|---|---|---|
| Person X: specifically approved email | ALLOW | All synthetic example layers permit this exact action |
| Person Y: its own specifically approved email | ALLOW | All synthetic example layers permit this exact action |
| Person Z: its own specifically approved email | ALLOW | All synthetic example layers permit this exact action |
| Person A: individual contact prohibited | DENY | Target risk ceiling exceeded |
| Person B: individual contact prohibited | DENY | Target risk ceiling exceeded |
| Person C: individual contact prohibited | DENY | Target risk ceiling exceeded |
| Person D: individual contact prohibited | DENY | Target risk ceiling exceeded |
| Person E: individual contact prohibited | DENY | Target risk ceiling exceeded |
| Person X: telephone was not approved | DENY | client does not allow this channel |
| Person X: SMS was not approved | DENY | client does not allow this channel |
| Approved person cannot substitute another destination | DENY | Exact destination/asset is not approved for this target |
| Unlisted person defaults to denied | DENY | Target has no explicit approval |
| Physical building entry forbidden | DENY | Target risk ceiling exceeded |
| High-risk action exceeds medium ceiling | DENY | Campaign risk ceiling exceeded |
| Target risk ceiling still applies | DENY | Target risk ceiling exceeded |
| Client denial overrides campaign and target allow | DENY | client explicitly denies this action |
| Target denial overrides its own allow list | DENY | target explicitly denies this action |
| Revoked campaign stops queued action | DENY | Policy is not currently approved |
| Policy revision changed after dispatch | DENY | Stale policy revision |
| Expired campaign | DENY | Outside the approved time window |
| Not yet valid | DENY | Outside the approved time window |
| Wrong campaign | DENY | Wrong campaign_id |
| Unknown risk label | DENY | Missing or malformed approval/action data |
| Missing target rule | DENY | Target has no explicit approval |
| Missing required destination | DENY | Exact destination/asset is not approved for this target |
| Production action deliberately refused by demo | DENY | Only synthetic examples are accepted by this demonstration |
| LOW label does not override a person denial | DENY | target explicitly denies this action |
| Public company intelligence specifically approved | ALLOW | All synthetic example layers permit this exact action |