# LLM red-team rules of engagement

Blank worksheet for an authorized exercise. This document grants no permission and executes nothing. Use isolated resources and synthetic data.

## Scope and authority

- Exercise owner:
- Written authorization reference:
- Target deployment and configuration versions:
- Permitted identities and environments:
- Start and end time, with time zone:
- Allowed input surfaces and techniques:
- Explicitly excluded systems, data and techniques:

## Protected outcomes

For each outcome, identify the test resource, expected boundary and observation source.

| Outcome to prevent | Synthetic target/data | Required observation | Observer |
| --- | --- | --- | --- |
| | | | |

## Operating limits

- Test call, duration and resource budgets:
- Approved destinations and fake sinks:
- Stop conditions:
- Person authorized to stop the exercise:
- Contact route if an unexpected effect occurs:
- Evidence storage, readers and retention:

## Finding record

- Finding ID:
- Candidate and policy versions:
- Initial state and synthetic fixture:
- Exact input delivery path:
- Attempted deviation:
- Model proposal:
- Policy decision:
- Executor and target observations:
- Actual consequence, or uncertainty still unresolved:
- Reproduction conditions and frequency:
- Fix owner and regression case:

Keep attempted, denied, dispatched and completed actions separate. A final refusal does not establish that no action ran.

## Cleanup and closure

- Test identities and credentials removed:
- Synthetic documents and persistent memory removed:
- Pending approvals and queued work resolved:
- Accepted operations reconciled:
- Findings linked to owners and retest evidence:
- Unexplored paths and unresolved observations:
- Exercise closure decision and owner: