The entire legal architecture of properly commissioned red team engagements is built around avoiding the
"unauthorised" element central to offences like those under the Computer Misuse Act, through documented authorisation from someone with genuine authority and activity that stays within agreed scope. "Grey hat" testing conducted without such authorisation - however well-intentioned - risks satisfying precisely that unauthorised element and incurring real criminal liability, regardless of the tester's motives or whether data was ultimately taken. This makes authorisation the decisive legal distinction (contradicting both A's claim of no difference and B's claim that authorisation is irrelevant), and the absence of data theft does not, on its own, make otherwise unauthorised access lawful (D) - unauthorised access itself can constitute an offence independent of what is subsequently done with any access obtained.