awesome-copilot/skills/audit-integrity/references/clarification-protocol.md

Clarification Protocol

Before you start the analysis, pause and ask the user a maximum of 2 targeted questions when:

• The system scope, asset boundary, or target module is ambiguous and you cannot infer it from the context
• A critical trust boundary or privilege tier is undefined
• The business context for impact prioritization or compliance framework selection is absent
• The programming language or framework cannot be detected from the workspace

Rules:

1. State your working assumptions explicitly and proceed.
2. Do not wait for confirmation unless the ambiguity alters the attack surface definition or trust boundary map.
3. Ask a maximum of 2 questions. If more ambiguity exists, document your assumptions and proceed.
4. If no ambiguity exists, proceed directly without questions.