Policy, Mandate and Rules of Engagement

All courses / AI Red Team / Module 2 / Chapter 7

Learning objectives

After the lesson the participant can:

• Match each usage mode to its policy instrument and state what the instrument fixes.
• Explain the roles in a TIBER-EU test and the four places where AI enters a threat-led test.
• Apply the six rules for offensive AI capabilities as dual-use controlled assets.
• Draft a rules-of-engagement manifest with scope, AI participation, stop conditions and an out-of-band stop path.

Key concepts

Three layers of policy

A statement approved by the management body, standards that interpret it for each usage mode, and enforceable rules as code at the AI gateway, the policy decision point and the pipeline gates. One rule that refuses an out-of-scope tool call serves several obligations at once.

Policy instruments by usage mode

Supplier assurance for Mode 0, acceptable-use standards for Modes 1 and 2, a governed skills and connector catalogue for Mode 3, decision records for Mode 4, and permission manifests and rules of engagement for Mode 5. Policy for Modes 1 and 2 is about people; for Mode 5 it is about boundaries.

Dual-use controlled assets

Reconnaissance pipelines, vulnerability-discovery models, emulation agent frameworks and scenario libraries. They are registered and restricted, bound to a mandate, contained, logged, limited in autonomy and used only inside the perimeter of own or contracted systems.

Rules of engagement as code

A machine-readable manifest naming approvers including every target-system owner, window, parties, scope by ATT&CK tactic or ATLAS technique, AI participation, safeguards, stop conditions, an out-of-band stop path, deconfliction and evidence. A change during an exercise is a new signed version.

Rollout gate per legal entity

The architectural implication of works-council rights and AI Act Article 26(7): a monitoring capability, or an exercise touching employees' accounts or endpoints, goes live in an entity only once its consultation is recorded as complete.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Why must rules of engagement be machine-readable and enforced when AI takes part, when a signed document was enough for a human red team?
2. The July 2026 incident failed through correlated controls. Which three requirements does the chapter derive for rules of engagement, and how would you verify each before an exercise starts?
3. Where would insider-threat analytics or user-behaviour scoring in your organisation meet Annex III point 4 of the AI Act and works-council rights, and what would the rollout gate need to record?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which provision does the chapter call the legal anchor for testing under NIS 2?

   1. The requirement in Article 21(2) for policies to assess the effectiveness of the measures
   2. The requirement in Article 23 for an early warning on significant incidents
   3. The requirement in Article 20 for members of management bodies to follow training
   4. The requirement in Article 4 that sector-specific acts take precedence
   Show the answer

   A. The requirement in Article 21(2) for policies to assess the effectiveness of the measures
   Article 21(2) lists policies to assess the effectiveness of the measures; the chapter concludes that an entity which cannot show its measures are effective has not met the obligation.

2. Under the chapter's rules for offensive AI capabilities, which autonomy applies?

   1. Level 4 Autonomous inside the red range, Level 2 Supervised elsewhere
   2. Level 2 Supervised, or Level 3 Bounded for catalogued, reversible emulations in a standing programme
   3. Level 3 Bounded by default in the red range, with Level 4 Autonomous permitted for read-only reconnaissance steps
   4. Level 1 Assisted only, since AI may never execute an emulation step
   Show the answer

   B. Level 2 Supervised, or Level 3 Bounded for catalogued, reversible emulations in a standing programme
   Rule five limits autonomy to Level 2 Supervised, or Level 3 Bounded for catalogued, reversible emulations in a standing programme; Level 4 Autonomous is never used for offensive work.

3. Why is the production scoring of the benefits-triage system out of scope in RoE-NR-2027-001?

   1. Because the contracted tester lacks a licence for that product
   2. Because high-risk AI systems are exempt from adversarial testing
   3. Because the system is hosted outside the EU and EEA
   4. So that the exercise cannot affect decisions about residents
   Show the answer

   D. So that the exercise cannot affect decisions about residents
   The benefits-triage system is a high-risk AI system; the chapter states that its production scoring is out of scope so the exercise cannot affect decisions about residents.