Design phishing and social engineering simulations with explicit authorization and measurable outcomes.