AI › Module 8 › Lesson 3
Policy and RoE
Policy and RoE literacy — acceptable use, scope document, disclosure rules — on `$AI_LAB` program only.
Visual · t32_policy_and_roe
Policy and RoE = named scope rows. $AI_LAB YOUR apps. Original Cyberlium.
Opening
RoE before prompts — name policy and rules-of-engagement on YOUR lab program before any eval or app test.
Policy and RoE literacy names: acceptable use policy reference, in-scope assets (YOUR `$AI_LAB` toys), out-of-scope refused list (stranger apps, fraud kits, prod without ticket), finding handling and disclosure category, data handling/redaction, and stop conditions. Analyst writes RoE one-pager for `$AI_LAB` toy program — cites Module 8-1 governance rows — documents stop-if-out-of-scope rule — without testing third-party LLM APIs without permission, without 'RoE' theater on unauthorized targets. Cyberlium ethics conditions. Lab row: RoE one-pager with ten scope items and refused paths.
1. Named RoE sections
Scope in, scope out, finding path, redaction, stop conditions — five literacy anchors.
In-scope = YOUR `$AI_LAB` toys and instructor stubs only.
Command guide
Try these commands — Named RoE sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST AI RMF Govern — https://www.nist.gov/itl/ai-risk-management-framework CISA AI — https://www.cisa.gov/ai OWASP LLM Top 10 — https://owasp.org/www-project-top-10-for-large-language-model-applications/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
cat > "$AI_LAB/governance/policy-and-roe.md" <<'EOF'
# AI Lab Policy and RoE — YOUR t32-ai folder
## Authorized
- Toy echo-bot, markdown notes, curl public docs
- Injection tests against YOUR bot only
## Prohibited
- Malware generation, deepfake fraud, stranger API scraping
- Automated jailbreak scripts vs third-party SaaS
## Evidence
- roe.txt, no-weaponized-ai.txt, allow-deny-list.txt
EOFCommand — copy this
grep -E 'Authorized|Prohibited|YOUR' "$AI_LAB/governance/policy-and-roe.md" grep NEVER "$AI_LAB/roe.txt" "$AI_LAB/notes/no-weaponized-ai.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST AI RMF Govern (https://www.nist.gov/itl/ai-risk-management-framework); CISA AI (https://www.cisa.gov/ai); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused paths
Stranger apps, jailbreak weaponization, deepfake fraud, prod without ticket — label red.
Stop condition triggers when scope unclear — document escalation stub.
3. Disclosure boundary
Lab findings → internal fix ticket — not public bypass or stranger disclosure.
Real prod finding outside lab → owner notify within org RoE category.
4. What you ship: policy and RoE one-pager
Ten scope items + refused paths + stop conditions + NEVER stranger app line.
5. What you record before the next lesson
Policy and RoE one-pager path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write RoE that includes 'any public LLM API for injection research.'
Right
RoE one-pager for `$AI_LAB` toy program. Next: Governance Lab.
Mission: policy and RoE one-pager
1) List ten in-scope items. 2) Five refused paths labeled. 3) Stop conditions and disclosure UTC. 4) Write NEVER stranger app testing line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Stop condition — minimum literacy?”
Knowledge Check
APPLY: Policy and RoE on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger app testing fits RoE.
True or False
Knowledge Check
APPLY: RoE includes:
Multiple choice