A financial services firm hires an external security team to test its customer portal. Management provides the testers with valid low-privilege user credentials and general documentation about the application's architecture, but withholds source code and administrative access. The goal is to simulate what an authenticated but non-privileged attacker could achieve. Which type of penetration test does this describe?