---
name: rt-scope-definition
description: "Define engagement scope — target list, IP ranges, domains, applications, exclusions, and asset prioritization. Creates scope.md in engagement docs. Use at Phase 1 Planning before any reconnaissance begins."
---

# rt-scope-definition

# Scope Definition Workflow

## Step 1 — Target Discovery
Ask operator to provide all known targets:
- Domain names (apex + subdomains if known)
- IP addresses / CIDR ranges
- Web application URLs
- Mobile app identifiers (bundle IDs)
- Cloud account identifiers (AWS Account IDs, Azure subscriptions)
- API base URLs

## Step 2 — Asset Prioritization
Rate each target:
- **P1 (Critical)**: Crown jewels — admin panels, auth systems, payment flows, databases
- **P2 (High)**: Important business systems — main application, APIs
- **P3 (Medium)**: Supporting services — landing pages, docs, blogs
- **P4 (Low)**: Informational targets — CDN, static files

## Step 3 — Technology Pre-identification
For each target, note if known:
- Web framework (WordPress, Laravel, Django, etc.)
- Hosting (AWS, Azure, GCP, on-premise)
- Authentication method (SSO, Firebase, custom)
- Known technology stack

## Step 4 — Define Exclusions
Document what must NOT be tested:
- Shared hosting where other clients exist
- Third-party services (Stripe, Twilio, etc.)
- Partner systems
- Specific IP ranges that are out of scope

## Step 5 — Save Scope Document
Create: `_rtexit-output/docs/engagement/scope.md`

Format:
```markdown
## In-Scope Targets
| Target | Type | Priority | Tech Stack |
| Exclusions |
| Testing boundaries |
```



Return "DONE: rt-scope-definition" when done.

## Scope Quality Checklist

| Item | Required? | Notes |
|---|---|---|
| Root domains | Yes | Include wildcard rules explicitly. |
| IP ranges | If applicable | CIDR notation and exclusions. |
| Applications | Yes | URL, environment, owner. |
| APIs | If applicable | Base URL and auth method. |
| Cloud accounts/projects | If applicable | Provider, account ID, region constraints. |
| Credentials | If provided | Roles, expiry, MFA process. |
| Exclusions | Yes | Assets, techniques, dates, data types. |
| Test windows | Yes | Time zone and freeze windows. |

## Output Files

- `_rtexit-output/docs/engagement/scope.md`
- `_rtexit-output/docs/engagement/contacts.md`
- `_rtexit-output/docs/engagement/assumptions.md`

## Common Mistakes

- Treating a parent domain as wildcard scope without approval.
- Testing production when only staging was approved.
- Assuming cloud resources are in scope because an app uses that provider.
- Forgetting third-party systems such as payment, CRM, CDN, or support tooling.
