Rules of engagement I want open during a test

Put the decision on the first page

Asset lists and dates are necessary, but they do not explain why a test step is allowed. State the question the exercise must answer and the final condition that would settle it. That gives the operator a reason to reject activity that is interesting but irrelevant.

Name the sponsor who can approve a change, the operational contact who can distinguish exercise traffic from an incident, and the person who can order an immediate stop. Include a phone or out-of-band route for the test window.

Describe identities and data, not only domains

A domain name rarely captures the real boundary. List the permitted tenants, accounts, roles, test objects and data classifications. Separate facts to be checked from actions that are authorised. “The test user has no admin role” is an assumption; “use this account for these read-only requests” is permission.

If a test requires customer data, another user’s account or a production write, say so explicitly. Otherwise keep it out. Ambiguity at this point usually appears later as an unsafe decision under time pressure.

• Named systems, tenants and accounts
• Allowed reads, writes, messages and credential use
• Request, account, data and concurrency budgets
• Evidence retention and redaction rules
• Cleanup owner and completion check

Use stops that an operator can observe

“Stop if something goes wrong” is not enough. Use conditions such as: an unowned record appears, latency crosses the agreed threshold, a control enters a degraded state, the target account changes unexpectedly, or the emergency contact is unavailable.

Pair each condition with the immediate action: stop the request sequence, preserve the last safe evidence, revert the marker, notify the named contact. A request and data budget adds another clear point at which to pause.

Treat a changed plan as a new decision

Real environments invalidate assumptions. If the required asset, privilege or technique differs from the approved plan, record the discovery and stop that branch. The sponsor can then accept or reject the additional risk in writing.

After the test, keep the approved plan, changes, activity timeline, evidence map, cleanup record and unanswered questions together. That record explains what happened far better than a final report that silently rewrites the original scope.