# Scenario brief
Proposed planning aid, not a completed assessment.

- Business workflow and owner:
- Attacker objective to examine:
- Starting information or access (demonstrated / assumed):
- Requested human decision:
- Expected legitimate route:
- Authorized stopping point:
- Account/device action, if separately approved:
- Protected operation, if separately approved:
- Evidence source and owner for each stage:
- Detection review window/system:
- Unresolved questions:
- Improvement owner and retest:

Keep an untested result explicit. Retain evidence references, not secrets.