Range Safety & Authorization Pack

A range holds software with known, unpatched, pre-authentication remote code execution. The governance has to be as real as the tooling — and it has to exist before the range does, not after something goes wrong.

Nine documents, delivered as an editable Word file and a print-and-sign PDF.

Five policies — Range Isolation, Acceptable Use, Egress Rule Baseline, Untrusted Code & PoC Handling, and the Defensive-Only Charter that states in writing what the range is and is not for.

Two signable attestations — the Isolation Attestation (zones, VLAN IDs, egress rules in force, date of the last verified egress test, signature line) and the No-Client-Data Attestation. These are the documents you hand a client who asks whether your lab can touch their data, and having them pre-written turns a two-week security review into a two-day one.

One client-facing document — Engagement Authorization & Rules of Engagement, flagged for legal review because it governs work on third-party systems. Range work on infrastructure you own needs no external authorization; the moment any of it touches a client environment it is a different activity and it needs this, in writing, every time.

One runbook — Lab Escape / Containment. What you do if something in the Range zone reaches somewhere it should not: isolate the host physically, preserve state for analysis before destroying it, verify what egress occurred from outside the range, rebuild from a clean template. You will almost certainly never use it. It is thirty minutes now and it is the difference between an incident and a story.

Plus a pre-market readiness checklist that gates using the range with or for a client.

Ship this before the range does. Works standalone — if you already have a lab, this is what makes it defensible.