This must have been the first time this pentest company did physical pentesting. With all the popularity pentesting has these days I'm not surprised that some

This must have been the first time this pentest company did physical pentesting. With all the popularity pentesting has these days I'm not surprised that some companies that try to make a quick buck don't understand how serious something like this is. Pentesters need an "out of jail for free" card, signed by all necessary stakeholders (as high up the mgmt chain from all organizations involved as needed) and carry that with them during such exercises. At least have a number of someone on hand to call for checking authorization. The fact they didnt do some basic paperwork before shines bad on the pentest company and now really means the pentesters broke the law. It's crazy. Poor guys, but they have to know better in this profession.