An employer generally cannot validly authorise testing against accounts and data it does not own or control, such as an employee's personal email account - attempting to do so would risk unauthorised access to a third party's (the employee's) private property/data, potentially exposing the tester and client to real legal liability regardless of the employer's own consent. The professionally sound response is to flag this complexity clearly and, absent some separate, specific, properly considered lawful basis (which would be unusual and requires careful legal input), generally exclude personal, non-employer-provided accounts from scope. This is not automatically permissible (C), a general engagement contract cannot retroactively legitimise access the client had no authority to grant in the first place (A), and testing personal accounts is certainly not a required element of a valid engagement (B) - most engagements appropriately exclude it.