# Target Scope Policy
#
# Defines the legal and ethical scope for what may be tested.
# Aligned with SPB-13 (attestation), SPB-14 (incident readiness).

version: 1

authorized_target_types:
  - own_project
  - third_party_with_explicit_consent

prohibited_test_classes:
  - production_systems_without_consent
  - third_party_without_consent
  - shared_multi_tenant_services
  - any_target_outside_signed_scope_authorization

required_consent:
  for: third_party_with_explicit_consent
  evidence:
    - signed_authorization_document
    - scope_statement
    - point_of_contact
    - permitted_test_window

evidence_retention:
  authorization_documents_years: 3
  scan_artifacts_days: 365
  finding_reports_days: 365
  redaction: enforce_secret_patterns_per_SPB_09

prohibited_actions:
  - lateral_movement_to_systems_outside_scope
  - data_exfiltration_for_any_purpose
  - destructive_actions_without_explicit_pre_authorization
  - persistence_implants
  - tampering_with_audit_logs

reporting_obligations:
  on_high_or_critical_finding:
    notify_owner_within_hours: 24
  on_evidence_of_real_incident_unrelated_to_test:
    notify_owner_immediately: true
    pause_test_until_response: true

approval_authority:
  initiate_run: security_owner
  override_prohibition: never