# How the Authorization Gate (`scope.md`) Works in reverse-skill: A Complete Technical Guide

> Discover how reverse-skill enforces authorization with its scope.md gate. Learn to grant auth status, configure network profiles, and set ready_for_act to true for real-world activities.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-21

---

**The reverse-skill repository enforces a hard authorization gate through the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file that blocks all real-world activities until `auth.status` is set to `granted`, the `network_profile` is configured, and `ready_for_act` is toggled to `true` via the `case-init` scripts.**

The reverse-skill framework treats authorization as *policy-as-code*, requiring explicit written consent before any reconnaissance or exploitation activity. All skill executions route through a validation layer anchored in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md), which generates a per-case [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) document acting as an immutable legal and technical checkpoint.

## Core Components of the Authorization Gate

The gate logic revolves around three mandatory fields defined in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md). Each field must satisfy specific constraints before the framework unlocks actionable commands.

### auth.status

Located at lines 50‑55 of [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md), this field must be explicitly set to `granted`. If the value remains `pending` or `denied`, the gate immediately blocks execution. In these states, the framework restricts access to documentation and routing files only, preventing any interaction with target systems.

### network_profile.mode

Defined at lines 65‑71 of the same contract file, this parameter declares the permissible network context. Valid modes include:

- `offline` – No outbound traffic permitted
- `lab_only` – Restricted to designated CTF or test-lab ranges
- `authorized_target_only` – Single approved target scope
- `unrestricted_lab` – Broader lab environment with documented constraints

The gate refuses any outbound traffic that violates the selected mode, preventing accidental engagement with production systems.

### ready_for_act

This boolean flag appears at lines 85‑86 and serves as the final latch. Once `auth.status` and `network_profile` pass validation, `ready_for_act` must be set to `true` to unlock the primary SKILL workflow. The `case-init` scripts automatically toggle this flag only after the scope file passes full validation.

## How the Gate Is Enforced

The authorization gate operates through a cascading enforcement chain that runs before any skill execution.

### Routing Entry and case-init

According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) (lines 94‑95), the master router (`master-route.ps1` or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh)) always invokes the initialization scripts before opening any primary skill:

```text
2. skills/scripts/case-init.ps1 – scope.md gate

```

The `case-init` scripts (available for both PowerShell and Bash) generate a fresh `work/<case>/scope.md` from the template in [`scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope-contract.md). They then validate the three core fields. If validation fails, the scripts exit with a clear error message and halt the workflow immediately.

### Hard-Gate Logic with case-guard

Throughout all skill implementations in `skills/**/SKILL.md`, every command that touches a target invokes the `case-guard` helper. This compatibility wrapper enforces the gate constraints. Even `case-guard -Force` or `--force` cannot bypass the authorization check, as explicitly prohibited in the checklist at lines 103‑104 of [`scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope-contract.md).

### Continuous Validation

The gate is re-verified at the start of **every** new skill execution. If a user invokes a tool while the scope is incomplete or invalid, the framework aborts with a message prompting the user to run `case-init` again.

## Practical Usage Examples

Initialize a new case on Linux or macOS to create the mandatory [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md):

```bash

# Create the case directory and scope template

bash skills/scripts/case-init.sh \
    --hint "Analyze suspicious Android APK" \
    --case-name "apk-analysis"

```

Edit the generated [`work/apk-analysis/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/work/apk-analysis/scope.md) to satisfy the gate:

```markdown

## auth

- status: granted          # <-- MUST be 'granted'

- basis: own_system
- evidence_of_auth: "internal approval ticket"

```

Validate the gate manually (this runs internally via `case-guard`):

```bash
case-guard

# Exits 0 if auth/granted + network_profile are valid

# If it fails:

# "Authorization gate not passed – run case‑init with a granted scope."

```

Once the gate passes, launch the primary skill:

```bash
bash skills/scripts/master-route.sh --hint "apk reverse"

```

For Windows PowerShell with an offline sample:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\case-init.ps1 `
  -Hint "offline apk" -CaseName "my-sample" `
  -Preset offline-sample -Sample .\app.apk

```

This offline path allows static analysis without network activity by pairing `auth.status=granted` with a local sample file.

## Why the Authorization Gate Matters

The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) gate provides three critical safeguards:

- **Legal Compliance**: Guarantees that active engagements are backed by a written contract (`auth.basis`) or explicit CTF lab permission, creating an immutable audit trail referenced by [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md).
- **Network Containment**: Prevents accidental traffic to production systems by strictly enforcing the `network_profile` mode at the routing layer.
- **Operational Integrity**: The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file becomes legal evidence of authorization, protecting researchers and organizations during compliance reviews or legal proceedings.

## Summary

- The authorization gate requires three fields in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md): `auth.status` must be `granted`, `network_profile.mode` must match the operational environment, and `ready_for_act` must be `true`.
- `case-init.ps1` and [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) generate and validate the per-case [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) before any skill runs.
- `case-guard` enforces the gate during skill execution and cannot be bypassed with force flags.
- The gate supports offline analysis via the `-Preset offline-sample` option for static reverse engineering without network access.
- Continuous enforcement occurs at every skill invocation, ensuring the authorization state remains valid throughout the engagement.

## Frequently Asked Questions

### What happens if I try to run a skill without setting `auth.status` to granted?

The framework blocks execution immediately. The `case-guard` helper detects the non-granted status and aborts with the error "Authorization gate not passed – run case‑init with a granted scope." Only documentation and routing files remain readable until the status is corrected.

### Can I bypass the authorization gate using the `--force` flag?

No. The `case-guard` implementation explicitly prohibits bypassing the gate via force flags, as documented in [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) lines 103‑104. The gate is architectural, not optional, and requires valid [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) configuration.

### How do I perform offline analysis without network authorization?

Use the offline-sample preset when initializing the case. Provide a local sample file (such as an APK or binary) and set `auth.status=granted` with `network_profile.mode=offline`. This satisfies the gate for static analysis without requiring external network permissions or target authorization.

### Where is the authorization evidence stored for audit purposes?

The `work/<case>/scope.md` file serves as the immutable authorization record, generated from [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md). This document is later referenced by [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md) to establish a complete audit trail of consent and operational parameters for compliance reviews.