# Statement of Engagement Authorization

| Field | Value |
|---|---|
| Engagement Reference | [REF] |
| Client | [CLIENT] |
| Client Sponsor | [NAME / ROLE / CONTACT] |
| Authorized Operator(s) | [NAMES] |
| Start Date | [YYYY-MM-DD] |
| End Date | [YYYY-MM-DD] |
| Scope Type | [blackbox/greybox/whitebox] |
| Methodology | [PTES/NIST/OWASP/TIBER/CBEST] |
| Classification | Confidential |

## 1. Purpose

This document authorizes RTExit operators to perform security testing against the assets, time windows, and techniques explicitly listed below.

## 2. Authorized Scope

| Asset | Type | Environment | Testing Window | Notes |
|---|---|---|---|---|
| [domain/app/IP] | [web/api/cloud/etc.] | [prod/stage/lab] | [window] | [notes] |

## 3. Exclusions

| Exclusion | Reason | Contact for Exception |
|---|---|---|
| [asset/technique/data] | [reason] | [contact] |

## 4. Approved Testing Categories

- [ ] Planning and documentation
- [ ] Passive reconnaissance
- [ ] Active reconnaissance
- [ ] Web/API testing
- [ ] Mobile/Desktop testing
- [ ] Network/Internal testing
- [ ] Cloud configuration review
- [ ] Active Directory testing
- [ ] Social engineering simulation
- [ ] Physical security assessment
- [ ] Post-exploitation validation

## 5. Rules of Engagement

| Rule | Value |
|---|---|
| Rate limits | [requests/sec, scan windows] |
| Accounts provided | [test users/roles] |
| Data access limits | [no PII dump, sample-only, etc.] |
| Destructive testing | [allowed/not allowed] |
| Social engineering | [allowed/not allowed and conditions] |
| Emergency stop contact | [name/phone/email] |
| Daily status cadence | [time/channel] |

## 6. Evidence Handling

Evidence must be stored under `_rtexit-output/docs/evidence/`, hashed with SHA-256 where practical, and referenced from findings by relative path.

## 7. Stop Conditions

Testing must pause immediately if service instability, unauthorized data exposure, legal uncertainty, client request, or safety concerns are observed.

## 8. Authorization

Client representative:

Signature/date:

RTExit operator:

Signature/date:
