# Implementing the Authorization Gate with case-init.ps1 and scope.md in reverse-skill

> Implement the authorization gate in reverse-skill by running case-init.ps1 to create scope.md before target operations. Secure your pre-execution flow.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**The reverse-skill repository enforces a strict pre-execution authorization gate that requires running `case-init.ps1` to generate a [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) contract before any active operation (ACT) can execute.**

The **reverse-skill** project is a platform-agnostic skill router designed for security automation tasks such as reverse engineering and penetration testing. Implementing the authorization gate with `case-init.ps1` and [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) ensures that every automated action operates within a predefined scope and maintains compliance with the repository's [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). This mandatory checkpoint prevents unauthorized operations by validating case metadata and network profiles before execution.

## Understanding the Authorization Gate Architecture

The authorization gate consists of two tightly-coupled components that work together to establish a security contract for each operation.

### The Role of case-init.ps1

Located at `skills/scripts/case-init.ps1`, this PowerShell script serves as the entry point for case initialization. It generates a **case definition** containing metadata including the case name, target URL, and network profile. The script validates inputs against unsafe patterns and aborts execution if required fields are missing.

When invoked with the `-Hint` parameter (e.g., `web pentest`), the script creates two critical artifacts under `work/<case>/`:

- [`case-init.txt`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.txt): Contains the case metadata
- [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md): The authorization contract defining permitted operations

### The Role of scope.md

The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file acts as the **scope contract** that declares what the case is allowed to do. This generated markdown file contains sections such as **Target**, **Allowed Tools**, and **Network Profile**. The routing engine reads this file to determine whether a requested ACT is permissible within the defined boundaries.

## How the Gate Enforcement Works

The repository implements multiple validation layers to ensure the gate is present before execution.

### Pattern Matching in Routing Engines

The routing scripts `master-route.ps1` and `verify-routing-coherence.ps1` enforce the gate through pattern matching. These scripts scan for the presence of `case-init` and `scope\.md` within a 400-character window preceding any `ACT` command. The specific regex patterns used include:

- `case-init.{0,400}ACT`
- `scope\.md.{0,400}ACT`

If these patterns are absent, the verification fails with an error message indicating the missing gate.

### Runtime Validation with case-guard.ps1

The `skills/scripts/case-guard.ps1` script provides a **runtime safeguard** that double-checks the existence and correctness of the scope contract. Called by higher-level scripts such as `smoke.ps1` and `test-p0-friction.ps1`, it aborts execution with a clear error if the scope is missing or malformed.

## Step-by-Step Implementation

Follow this workflow to properly implement the authorization gate before executing any skill operations.

1. Initialize the case using `case-init.ps1` with your task hint and target details:

```powershell

# Initialize a web-pentest case called "my-pentest"

powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -CaseName "my-pentest" `
    -TargetUrl "https://example.com" `
    -NetworkProfile "lab_only"

```

This command validates the case name against unsafe patterns and writes [`work/my-pentest/case-init.txt`](https://github.com/zhaoxuya520/reverse-skill/blob/main/work/my-pentest/case-init.txt) and [`work/my-pentest/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/work/my-pentest/scope.md). The generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) includes the **Target** section and **Network Profile** (`lab_only`).

2. Verify the routing coherence to confirm the gate is properly recognized:

```powershell

# Verify the authorization gate is detected before any ACT

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/verify-routing-coherence.ps1

```

Look for `Ok "$name has case-init/scope gate"` in the output. A missing gate produces `Bad "$name missing case-init/scope/network_profile gate"`.

3. Execute the skill operation only after gate validation:

```powershell

# Start the IDA reverse skill after gate verification

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/ida-reverse/scripts/start.ps1 -CaseName "my-pentest"

```

The `start.ps1` script internally invokes `case-guard.ps1` to verify the scope before launching the reverse-engineering workflow.

## Key Files in the Authorization Workflow

Understanding these source files helps debug gate-related issues and extend the architecture:

- **`skills/scripts/case-init.ps1`**: Generates case metadata and scope contracts; enforces input validation and safe case naming.
- **`skills/scripts/case-guard.ps1`**: Runtime guard ensuring the gate is present before downstream execution.
- **`skills/scripts/verify-routing-coherence.ps1`**: Scans routing definitions for the mandatory `case-init`/[`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) patterns before any ACT.
- **`skills/scripts/master-route.ps1`**: Core routing engine that parses hints, selects skills, and enforces the authorization gate.
- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**: The single source of truth defining the mandatory `case-init/scope` gate requirement.
- **[`examples/ctf-demo/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/examples/ctf-demo/scope.md)**: Reference implementation showing a typical scope contract layout.

## Summary

- The **authorization gate** requires running `case-init.ps1` before any ACT operation to generate the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) contract.
- **Pattern matching** in `master-route.ps1` and `verify-routing-coherence.ps1` validates the gate presence using 400-character window searches for `case-init` and [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md).
- **`case-guard.ps1`** provides runtime validation, aborting execution if the scope contract is missing or malformed.
- The gate architecture ensures **pre-execution authorization** as mandated by [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), preventing unauthorized security operations.

## Frequently Asked Questions

### What happens if I try to run an ACT without initializing a case?

The routing engine will detect the missing authorization gate through pattern matching and fail with a `Bad` status message indicating the missing `case-init/scope/network_profile gate`. The `case-guard.ps1` script will also abort execution with a clear error before any operational code runs.

### How does the routing engine detect the authorization gate?

The engine uses regex pattern matching within a 400-character window preceding any ACT command. It searches for `case-init.{0,400}ACT` and `scope\.md.{0,400}ACT` patterns in the routing definitions to ensure the gate artifacts exist before permitting execution.

### Can I manually edit scope.md after case initialization?

While technically possible, manual edits risk violating the contract validation performed by `case-guard.ps1`. The scope contract is designed to be generated by `case-init.ps1` to ensure consistent formatting and valid content that matches the expected patterns in the routing engine.

### What validation does case-init.ps1 perform on inputs?

The script validates that the case name is safe (checking against unsafe patterns), verifies the presence of required fields like **network profile**, and ensures the target URL is properly formatted. It aborts immediately if any validation fails, preventing the creation of incomplete or unsafe scope contracts.