Cyber Exercise Control

That violates the **cyber-exercise-control P0 guardrail**: crossing an exclusion is **scope drift**, requiring an immediate stop. “White-team work” does not authorize continuation, attack activity, production changes, or real-target contact.

Required action:

1. Pause/stop the exercise and log the event, authority, time, scope change, and abort reason.
2. Preserve evidence; do not self-adjudicate. Hand observations to independent adjudication.
3. Obtain fresh authorization, confirm exclusions, synthetic-data boundaries, runtime support, roles, and abort conditions.
4. Record the restart decision and resume only after all safety gates pass. If runtime controls are unsupported, use offline inject design.

Evidence needed: approved scope and authorization, exclusion definition, event timeline, affected assets/data, evidence references, runtime/safety validation, accountable owner, and the recorded reauthorization/restart decision.