Municipal policy bans certain automated exploitation frameworks on OT segments listed in the Rules of Engagement. What should the tester do?

When municipal policy bans certain automated exploitation frameworks on OT segments listed in the Rules of Engagement, the tester must honor the ban on those segments and continue only with approved methods. Quietly running Metasploit anyway because OT findings “matter more than paperwork” violates authorization and can disrupt fragile industrial systems the city explicitly protected. Skipping OT testing entirely rather than changing tools abandons in-scope objectives that may still be reachable with allowed techniques. Asking the network team to move OT hosts onto the IT VLAN so frameworks become allowed is an unauthorized architecture change that expands blast radius and is not a tester’s remediation shortcut. Exam caveat: RoE tool restrictions are binding even when a technique is popular in training labs. Operational check: annotate OT CIDRs and banned tooling in the daily plan, switch to approved methods (manual review, vendor-approved checks, or listed alternatives), and escalate in writing if the city wants the ban reconsidered—never by silent bypass. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.