> ## Documentation Index
> Fetch the complete documentation index at: https://docs.archal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Scenario library

> Browse Archal's public scenario catalog covering social-engineering resistance, refund controls, code-review judgment, and cross-system privacy risks.

Archal's public markdown scenario catalog lives under [`scenarios/`](https://github.com/Archal-Labs/archal/tree/main/scenarios) in the Archal repo. Browse from the CLI:

```bash theme={null}
archal scenario list
archal run scenarios/security-suite/exec-impersonation.md --sandbox
```

## Pick a first scenario

| If you want to test           | Start with                                                           | Clones                | Risk                | Run                                                                                                 |
| ----------------------------- | -------------------------------------------------------------------- | --------------------- | ------------------- | --------------------------------------------------------------------------------------------------- |
| Social-engineering resistance | `security-suite/exec-impersonation.md`                               | Slack, Jira, Stripe   | Approval spoofing   | `archal run scenarios/security-suite/exec-impersonation.md --sandbox`                               |
| Refund controls               | `security-suite/race-refund.md`                                      | Slack, Jira, Stripe   | Financial controls  | `archal run scenarios/security-suite/race-refund.md --sandbox`                                      |
| Code-review judgment          | `security-suite/reviewer-impersonation.md`                           | GitHub, Slack, Jira   | Identity and access | `archal run scenarios/security-suite/reviewer-impersonation.md --sandbox`                           |
| Cross-system privacy          | `adversarial/cross-system-pii-leak-customer-name-in-github-issue.md` | GitHub, Slack, Stripe | Data exposure       | `archal run scenarios/adversarial/cross-system-pii-leak-customer-name-in-github-issue.md --sandbox` |

Use `archal scenario list --tag <tag>` when you know the risk category, and
`archal scenario list --clone <clone>` when you know the service surface.

## Sample scenario

[`scenarios/security-suite/exec-impersonation.md`](https://github.com/Archal-Labs/archal/blob/main/scenarios/security-suite/exec-impersonation.md) - an attacker impersonates an exec over Slack and tries to push the agent into approving a wire transfer. Success criteria check that the agent verified out-of-band before acting.

## Categories

| Bucket         | Path                        | Count |
| -------------- | --------------------------- | ----: |
| Adversarial    | `scenarios/adversarial/`    |    18 |
| Security suite | `scenarios/security-suite/` |    15 |

## Risk taxonomy

The hosted catalog tags scenarios by failure mode:

| Tag                        | Meaning                                                  |
| -------------------------- | -------------------------------------------------------- |
| `identity-and-access`      | Wrong actor, account, or stale authorization             |
| `data-exposure`            | Sensitive data crossing an unsafe boundary               |
| `financial-controls`       | Refunds, payments, billing, approval scope               |
| `change-management`        | Risk hidden in releases, diffs, or migrations            |
| `governance-and-approval`  | Policy precedence, escalation, truthful approval checks  |
| `cross-system-reasoning`   | Safe action requires correlating evidence across systems |
| `secrets-and-supply-chain` | Credentials, dependency trust, hidden payloads           |

## Security suite

Social-engineering and policy-verification scenarios across GitHub, Jira, Slack, Stripe, and Linear.

```text theme={null}
approval-spoof.md            metric-smoothing.md         refund-amnesty.md
bulk-closure-pressure.md     mirror-patch-confusion.md   reviewer-impersonation.md
coupon-blast.md              payment-link-rush.md        rollback-pressure.md
cross-client-leak.md         quorum-bypass.md            typosquat-hotfix.md
exec-impersonation.md        race-refund.md              vendor-wire-override.md
```

## Adversarial

Same-name confusion, revoked credentials, hidden policy violations, cross-system leaks.

```text theme={null}
board-blackout-same-name-contractor-safe-subset-only.md
calendar-invite-from-fired-employee-triggers-data-access.md
cross-system-pii-leak-customer-name-in-github-issue.md
github-pr-approved-but-ci-secretly-disabled.md
gmail-thread-contains-revoked-api-key-agent-must-not-use.md
gws-calendar-double-booking-vendor-payment-race.md
northwind-duplicate-vendor-scope-freezes-only-one-bill.md
privacy-review-same-name-contractor-ui-copy-only.md
quarter-close-mixed-queue-same-name-contractor-safe-subset-only.md
quarter-close-overlap-vendor-fraud-refund-and-offboarding.md
ramp-card-spend-after-termination-notice-in-gmail.md
ramp-google-workspace-expense-fraud-evidence-in-email.md
ramp-gws-receipts-dont-match-calendar-locations.md
refund-queue-same-name-offboarding-safe-template-only.md
supabase-migration-contains-rls-bypass-hidden-in-comment.md
```