// Draft — pending counsel
Scope and authorization
This is the shape of the document your client's counsel will sign, written down before it is finished. It is not legal text and no lawyer has read it yet. You are seeing it early so you can mark it up while the structure can still change.
- Status
- Draft. With counsel.
- Reviewed by a lawyer
- No. Not one line of it.
- Finished version
- Goes to every partner by 30 September 2026.
- What it is for now
- Checking the structure covers your client, and telling us if it does not.
01 — Authorization letter
Who at the client holds the authority to authorize testing of the named environment, what exactly they are authorizing, and the window it runs for. Countersigned by you.
Still with counsel: Warranty language, and what happens to the authorization when the signer leaves mid-engagement.
02 — Scope schedule
The targets, objectives and exclusions the schedule is written to — the same scope the Operation runs against, so the paper and the product cannot drift apart. Carries the out-of-scope assets, the blackout windows and the data-handling limits.
Still with counsel: Whether the schedule is an annex to your own client contract or a standalone document both sides sign.
03 — Rules of engagement
The approval mode the engagement runs in — every action approved by hand, or agent discretion that halts and notifies — with the escalation contacts on both sides, the stop procedure, and who is entitled to invoke it.
Still with counsel: What you are obliged to report, and how fast, when an Operation surfaces evidence of a live compromise. This differs by jurisdiction.
04 — Evidence and retention
What the Artifact chain holds, where it is stored, who can read it, how long it is kept, and how it is destroyed.
Still with counsel: The retention floor you need to defend the engagement later, against a client asking for deletion. Cross-border storage sits in the same clause.
05 — Third-party infrastructure
Where the client's systems sit on infrastructure the client does not own, the provider's own testing policy applies on top of the client's authorization.
Still with counsel: This is the clause most likely to be wrong if engineers draft it, and it is the reason the rest is still waiting.
What to do with it
Mark it up and send it back to as@cracken.ai. A redlined draft is worth more to counsel than a clean one. If your client's counsel would rather talk it through — scope, approval mode, retention — an engineer takes that call within one business day.