Security Engagement Scope Register

The authorization of record for security testing, and the gate that enforces it: in-scope targets (hosts, wildcard domains, CIDR), explicit exclusions that always win over inclusions, permitted environments and test kinds, the named human who authorized it, an emergency contact and a hard expiry. Answers "may I touch this?" before anything runs, and logs every refusal as evidence the gate worked