| Legal authorization | Restrict testing to owned systems or targets with documented permission; define assets, dates, techniques, exclusions, and emergency contacts. | Rules-of-engagement template; sample authorization letter with confidential details redacted. |
| Identity & access | Limit model access to named, approved internal analysts and applicable organization/workspace or API project; apply least privilege and strong account security. | Role assignment and access review process; approved workspace ownership details. |
| Segregated operation | Keep authorized Daybreak use separate from customer-facing apps, downstream traffic, resale, sharing, or proxy access. | Internal-only architecture and data-flow diagram. |
| Human oversight | Use explicit review points for higher-risk research, exploit-chain validation, and decisions affecting live environments; retain stop authority. | Approval checkpoints, escalation playbook and exception log design. |
| Data handling | Minimize, classify and redact case content as needed; confirm data-processing arrangements and any separate retention approvals before uploading sensitive information. | Data handling standards, client authorizations and retention matrix. |
| Audit & escalation | Maintain appropriate records of scope, tool use, review decisions, findings and incident escalation, subject to privacy and provider terms. | Engagement log schema, reviewer assignment and incident reporting route. |