# Rules Of Engagement

> Design and enforce Rules of Engagement (RoE) for offensive security tests — scope, allowed TTPs, safety stops, deconfliction, and legal authority. Use before any red team, adversary emulation, or high-impact offensive exercise.

- Skill: `itsual/rules-of-engagement` (Agent Skill)
- Install (CLI): `npx skillmds@latest add itsual/rules-of-engagement`
- Raw SKILL.md: https://api.skillmd.com/api/skills/itsual/rules-of-engagement/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: itsual (https://skillmd.com/u/itsual)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/itsual/rules-of-engagement

---


# Rules of Engagement

## Overview

Rules of Engagement are the binding constraints that keep offensive testing lawful, safe, and aligned to objectives. No technical activity should start without approved RoE.

## When to Use

- Scoping red team or adversary emulation engagements
- Defining safe boundaries for social engineering or physical tests
- Establishing emergency stop and escalation paths
- Deconflicting offensive activity with SOC/IR

## Core Practices

- Document in-scope and out-of-scope systems, data, people, and locations
- Explicitly allow or forbid tactic classes (phishing, DoS, physical, destructive actions)
- Define objectives/flags and success criteria
- Set time windows, blackout periods, and rate limits where needed
- Name emergency contacts and kill-switch authority
- Define deconfliction process (how defenders recognize authorized testing when applicable)
- Specify data handling, evidence retention, and disclosure rules
- Obtain written approval from authorized stakeholders before start

## Principles

- RoE is a control document, not boilerplate to skip
- “Assume it’s allowed” is how tests become incidents
- Safety of production and people outranks engagement drama
- Changes mid-engagement require re-approval when scope expands

## Verification

- [ ] RoE is written, approved, and acknowledged by operators
- [ ] Emergency stop path is tested or clearly understood
- [ ] Scope boundaries are unambiguous to the executing team