▣
AuthorizationWork only inside approved authority.
Policy surface
Policy is how intent becomes repeatable behavior.
The engagement standard is reinforced by clear rules for authorized conduct, ethics, confidentiality, client data, and disclosure. They are operational guardrails, not website boilerplate.
Policy around the delivery model
§
EthicsNo improper influence on procurement or outcomes.
▰
ConfidentialityClient material remains protected and purpose-limited.
↗
DisclosureExternal communication follows authority and obligation.
Policy → consistent conduct → trusted delivery
Operating guardrails
The rules stay attached to the work.
These principles are translated into scoping, execution, evidence handling, communication, and delivery decisions rather than treated as separate administrative documents.
Four policy guardrails
▣
Authorized conductPermission is a technical input.
§
Anti-briberyCommercial pressure does not alter professional conduct.
▰
ConfidentialityClient material remains client-owned and need-to-know.
↗
DisclosureFindings are coordinated, not marketed.
Confidentiality & data handling
Collect less. Control access. Deliver only what is needed.
Security testing can expose privileged information. Black Bag’s policy is to minimize collection while preserving enough evidence to support material conclusions.
Data handling lifecycle
◫
CollectNecessary material only▣
ControlAuthorized need-to-know access▰
StoreApproved controlled environment↗
DeliverSanitized approved artifact✓
Retain / deleteWritten engagement requirementClient data is not placed in unmanaged third-party AI systems.
Coordinated disclosure
The client controls the engagement story unless law requires otherwise.
Client identity, findings, access, and engagement details are not publicly shared without written permission. Vendor or third-party coordination is handled through approved channels and timelines.
Disclosure guardrail
01
Client authorityWhat communication has been approved?
02
Legal / contractual obligationWhat requirement overrides normal confidentiality?
03
Coordinated actionRight stakeholder · channel · timing · record
Policy questions are engagement questions
If your organization has specific ethical, confidentiality, residency, or disclosure requirements, make them explicit before work begins.
Black Bag will incorporate approved constraints into the engagement operating model.
Make constraints explicit
§
EthicsApplicable conduct requirements.▰
ConfidentialityWho may see what.⌖
ResidencyWhere material may exist.↗
DisclosureWho controls external communication.✓
AgreementTurn requirements into operating controls.