# Rules of Engagement — TEMPLATE (fill before active testing)

## Ownership and approval
- Owner / authorized approver: **REQUIRED — fill in**
- Written authorization date: **REQUIRED**
- Source repository/revision(s): **REQUIRED**
- Approved staging hostnames/IPs and ingress origin: **REQUIRED**
- Explicitly in-scope containers, endpoints and internal mock services: **REQUIRED**
- Out of scope: production by default; third-party IDPs/payment providers; every other household service; non-owned accounts or data.

## Staging prerequisites
- Independent database, object/file storage, volumes and backups: [ ]
- Synthetic tenant A, tenant B and admin identities: [ ]
- Synthetic CVs, canary records and nonfunctioning fake credentials: [ ]
- OAuth/payment/webhook/email sandbox or mock: [ ]
- Access controls and outbound network restrictions: [ ]
- Observability, snapshot/rollback and emergency stop: [ ]
- Current baseline and staging safety smoke test: [ ]

## Approved attack classes
Individually check only after approval: [ ] low-rate authenticated negative testing; [ ] file handling with harmless fixtures; [ ] targeted source-guided injection tests to mocks; [ ] passive ZAP; [ ] capped active ZAP; [ ] infrastructure config tests; [ ] backup/restore in isolated test DB.

## Limits
- Max requests/sec and concurrency: **REQUIRED before network tests**
- Maximum test duration / windows: **REQUIRED**
- Excluded URL patterns/assets: **REQUIRED**
- Stop signal and contact: **REQUIRED**
- Stop on production data, unexpected hosts, resource exhaustion or unclear ownership.

## Evidence protection
No raw cookies/keys/PII in repo or prompts. Sanitized examples only. Controlled evidence stored securely, access-limited and deleted per policy. Reviewer sign-off required before stage 13 and any active scan.