Each engagement has a clearly defined scope. Changes to production accounts, access permissions, retention requirements, and remediation actions must be approved by the client. Attack reconstruction is limited to conclusions supported by the available evidence.