# How to Initialize a New Case with Proper Authorization Scope Before Starting Analysis

> Learn the workflow for initializing a new case with proper authorization scope using case-init. Set auth status and network profile before analysis to ensure security.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-19

---

**Run `case-init` to create a new case directory with [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), then set `auth.status=granted` and a valid `network_profile` before any ACT can proceed.**

The **reverse-skill** repository enforces a strict **authorization-gate** workflow that prevents any network interaction or exploitation until proper scope and authorization are documented. This security model is codified in the rule engine ([`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)) and implemented through the `case-init` scripts. Understanding this workflow is essential for anyone preparing to conduct authorized security analysis using this framework.

## The Authorization-Gate Architecture

The gate consists of two mandatory components that must exist before any downstream skill can execute:

- **`case-init`** – Scaffolds the case directory and generates core files
- **[`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md)** – Records authorization status and network access permissions

According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) line 94, `case-init.ps1` is the **only authorized entry point** for creating scope. The `case-guard` scripts enforce this requirement at runtime, aborting execution if the gate conditions are not met.

## Step-by-Step Initialization Workflow

### Step 1: Create the Case Directory

Run the initialization script with a descriptive hint and optional case name. If omitted, the script generates a timestamped name automatically.

**PowerShell:**

```powershell
powershell -File skills/scripts/case-init.ps1 -Hint "web pentest" -CaseName "acme-2024"

```

**Bash:**

```bash
bash skills/scripts/case-init.sh --hint "offline apk" --case-name apk-demo

```

The script creates `work/<case>/` with subdirectories: `evidence/`, `notes/`, `report/`, and the mandatory [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file.

### Step 2: Resolve Authorization Status

The script determines `auth.status` (default: `pending`). Grant authorization through one of three methods:

| Method | How | Result |
|--------|-----|--------|
| **`-AuthGranted` flag** | Explicit parameter | `auth.status=granted` with `EvidenceOfAuth` populated |
| **Authorization preset** | `-Preset offline-sample`, `ctf-public`, or `own-system` | Automatic grant with predefined evidence |
| **Manual verification** | External authorization workflow | Update [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) post-initialization |

Implementation at `case-init.ps1` lines **16-26** (flag handling) and **58-78** (preset processing).

### Step 3: Choose a Network Profile

Define what network access is permitted:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "internal web app" `
    -AuthGranted `
    -NetworkProfile authorized_target_only

```

Available profiles include:
- `authorized_target_only` – Strict whitelist of in-scope assets
- `lab_only` – Isolated laboratory environment
- `offline` – No network access (default for samples)

Parsing logic at lines **98-101**; alias normalization at **58-66**.

### Step 4: Populate In-Scope Assets

Provide explicit targets or let the script extract from the hint:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -TargetUrl "https://app.internal.example" `
    -InScopeAssets @("10.0.1.0/24","app.internal.example")

```

Asset collection implemented at lines **35-49**. Without explicit assets, the script attempts host extraction from the hint parameter.

### Step 5: Finalize for ACT Readiness

The script evaluates readiness at lines **72-88**. Both conditions must satisfy:
- `auth.status` equals `granted`
- `network_profile` is non-`offline` **OR** case uses an explicit offline sample preset

When satisfied, `ready_for_act=true` is written to [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md).

### Step 6: Verify the Gate Before Execution

Run `case-guard` to validate the authorization gate before invoking any analysis:

```powershell
powershell -File skills/scripts/case-guard.ps1 -CaseName "acme-internal"

```

This script (and `verify-routing-coherence.ps1` tests) confirms that [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) exists with all required fields. Execution aborts with actionable errors if validation fails.

## Preset-Based Quick Initialization

For common scenarios, use presets to streamline steps 2-3:

| Preset | Use Case | Automatic Settings |
|--------|----------|------------------|
| `offline-sample` | Malware analysis, static reverse engineering | `auth.status=granted`, `network_profile=offline` |
| `ctf-public` | Capture-the-Flag competitions | `auth.status=granted`, `network_profile=ctf_public` |
| `own-system` | Testing on equipment you own | `auth.status=granted`, `network_profile=authorized_target_only` |

**Example with preset:**

```bash
bash skills/scripts/case-init.sh \
    --hint "CTF web challenge" \
    --case-name ctf-demo \
    --preset ctf-public \
    --target-url https://challenge.example

```

## The Master Routing Integration

Once initialized, the **master-route** script orchestrates downstream execution. Per [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md), the canonical sequence is:

```

master-route → case-init → scope.md → primary skill

```

The routing ensures that timeline tracking ([`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md)) and workitem management ([`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md)) remain synchronized with the authoritative [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) throughout the engagement.

## Key Source Files Reference

| File | Purpose |
|------|---------|
| `skills/scripts/case-init.ps1` | PowerShell implementation with auth resolution (lines 16-26, 58-78, 72-88) and asset collection (35-49) |
| [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) | Bash equivalent for Unix environments |
| [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) | Schema documentation for `auth.status`, `network_profile`, `in_scope.assets` |
| `skills/scripts/case-guard.ps1` / [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) | Runtime gate enforcement |
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) / [`RULES_zh.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES_zh.md) | Rule engine declaring the authorization-gate requirement |
| [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | Entry-point sequence documentation |
| [`skills/field-journal/precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-auth.md) | "Read-first" principle for case initialization |

## Summary

- **Initialize** with `case-init.ps1` or [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) to scaffold `work/<case>/` and [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md)
- **Grant authorization** via `-AuthGranted` flag, preset selection, or manual workflow
- **Define network scope** with `-NetworkProfile` appropriate to your engagement type
- **Populate assets** explicitly with `-TargetUrl` or `-InScopeAssets`
- **Verify readiness** using `case-guard` before any ACT execution
- **Respect the gate**: The rule engine prohibits bypassing `case-init` for any analysis involving network interaction

## Frequently Asked Questions

### What happens if I try to run analysis without initializing a case first?

The `case-guard` script intercepts execution and aborts with an error indicating missing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) or unauthorized status. Per [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), no ACT—including network scanning or exploitation—can proceed without passing this gate.

### Can I change authorization status after initialization?

Yes. While `case-init` sets the initial state, you may manually edit [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) to update `auth.status` and `EvidenceOfAuth` if your authorization workflow completes post-initialization. Re-run `case-guard` to verify the updated gate state.

### Which preset should I use for malware analysis?

Use `offline-sample`. This preset automatically grants authorization (you own the sample) and locks the network profile to `offline`, preventing accidental network egress from analyzed specimens.