rules of engagement

Build an authorized evaluation with synthetic identities, a fidelity matrix and controlled effects after real permission checks. Report what the harness proves and what remains untested.

Turn a threat model into an executable agreement: authorized work, real checks, controlled effects, protected evidence and clear stop and restart decisions.

Respond to a suspected credential exposure without testing it against an excluded service. Preserve restricted evidence and coordinate owner-led containment.