# Clarification Protocol

Before you start the analysis, pause and ask the user a maximum of **2 targeted questions** when:

- The system scope, asset boundary, or target module is ambiguous and you cannot infer it from the context
- A critical trust boundary or privilege tier is undefined
- The business context for impact prioritization or compliance framework selection is absent
- The programming language or framework cannot be detected from the workspace

**Rules:**

1. State your working assumptions explicitly and proceed.
2. Do not wait for confirmation unless the ambiguity alters the attack surface definition or trust boundary map.
3. Ask a maximum of 2 questions. If more ambiguity exists, document your assumptions and proceed.
4. If no ambiguity exists, proceed directly without questions.