This is not a definitive list of things you cannot do,
but I hope they will give you a good grounding. Never
impersonate a member of the emergency services,
especially the police.
This is not only illegal, but it can cause undue
distress and disruption to the company,
its employees, and even the surrounding areas may be affected. Never
purposely set off a fire alarm or call in a bomb threat.
No violence ever against any individual.
In very rare circumstances, simulated violence may be approved,
but just assume that this will never be okay, so don't even ask if you can do
this. Never impersonate someone of an authority that can cause undue distress to
the employees. You are not there to scare people,
but to help them become more secure.
Never break anything such as a window unless approved to do so.
You must always try to leave the premises in at least the same
security level as when you started.
For example, if you pick a lock to gain access,
remember to lock the door before you leave. You may inadvertently allow a
criminal to enter. Never attempt any social engineering or physical attack
on anywhere you do not have permission to be.
This is especially important if the target is in a shared
building. Think wisely and use caution on how and what you
can do in shared office spaces.
Do not waste your time or your clients by trying to perform stunts such as
getting a job in the post room or job as a pizza delivery boy.
Whilst some clients may want to simulate a disgruntled employee or see
what areas a visitor may be able to access, this is not the normal type of
engagement. Delivery people can be simulated.
Again, this can happen, but it is normally not required.
You will have much more success gaining access with a suit,
or similar, than as a delivery person.