Exercise 2: Why Exploitation Can't Precede Pre-Engagement — Possible Solution
====================================================================

THE HYPOTHETICAL
------------------------------
What would go wrong if the exploitation step (step 6 — actually
attempting the SQLi/session-cookie proof-of-concept) had been
attempted before the pre-engagement step (step 1 — the RoE actually
being signed) had completed?

THE CORE PROBLEM: NO AUTHORIZATION EXISTS YET
------------------------------
Per pentest1-1's own material, written authorization is "the single
non-negotiable precondition" before any testing activity happens at
all, and accessing a system without it is a real crime under statutes
like the CFAA "regardless of intent." If exploitation happened before
the RoE was signed, there would be no written authorization in
existence at the moment the SQLi payload was actually sent to
Meridian's checkout field — meaning the tester would, at that exact
moment, be committing genuinely unauthorized access, indistinguishable
at a legal level from a malicious attacker doing the identical thing.

THE SCOPE PROBLEM COMPOUNDS IT
------------------------------
Even setting the authorization gap aside, pentest1-2 established that
scope has to be defined precisely in writing before testing — the RoE
is what specifies that shop.meridianretail.example and
api.meridianretail.example are in scope while payments.
meridianretail.example is explicitly excluded. Without the RoE
completed first, the tester would have no confirmed, written boundary
for what's actually authorized — they might, entirely in good faith,
test systems (like the payment processor's own infrastructure) that
were never actually meant to be included, exactly the shared-
infrastructure risk pentest1-2's own warn-box described.

THE TESTING-WINDOW PROBLEM ALSO COMPOUNDS IT
------------------------------
The RoE also specifies the authorized testing window ("weekdays,
22:00-06:00 local time only... per pentest1-5's own scan-intensity
guidance"). Exploitation attempted before the RoE was finalized could
easily happen outside that window, at a time Meridian never actually
agreed testing should occur — risking exactly the kind of disruption
pentest1-5's own warn-box warned real, unrestricted-timing testing
can cause.

WHY THIS WORKS AS AN ANSWER
------------------------------
It identifies three separate, concrete things the pre-engagement step
actually establishes (authorization itself, precise scope boundaries,
and the testing window) that exploitation would violate if attempted
first, rather than a single vague "it would be illegal" answer.