Define legal scope, rules of engagement, and authorization artifacts for downstream pentest execution.