The "gray box testing" methodology enforces what kind of restriction?

Knowing only the internal operation with no external perspective describes a partial white box approach, not gray box.

Complete knowledge of internal operations defines white box (clear box) testing, where the tester has full access to source code and architecture.

In gray box testing, the tester is given limited internal information - such as partial architecture diagrams, some credentials, or high-level design documents - but does not have full access to source code or complete system internals. This simulates an attacker who has obtained some insider knowledge, making it more realistic than pure black box testing while still preserving blind spots that white box testing eliminates.

Access to only the external operation with no internal knowledge defines black box testing, which simulates a completely uninformed external attacker.