Related: there's a reason the Certified Ethical Hacker course places such emphasis on getting written permission before doing anything.

If you're messing with someone's systems, or (as in this case) with someone's processes, you don't get to claim to be the good guy unless they agreed to it before the fact. It's not rocket science.