A municipal RoE lists exact CIDR blocks allowed for lateral movement. The tester’s tunnel can technically reach an unlisted research segment. What should they do?

When municipal RoE lists exact CIDR blocks for lateral movement and a tester’s tunnel can technically reach an unlisted research segment, the correct action is to keep pivots inside the approved CIDRs and raise the unlisted route as a scope question. Expanding because technical reach equals authorization is the classic scope failure in civic tests. Documenting the route privately and testing without telling the client withholds material scope risk from the sponsor. Treating unlisted segments as bonus scope once any foothold exists invents implied authorization the letter of engagement never granted. Exam caveat: CPTS ethics favor pause-and-ask over opportunistic expansion, even when the path is easy. Operational check: screenshot or note the discovered route without traversing it, email or ticket the scope question to the municipal point of contact, and resume only after written clarification amends CIDRs or explicitly denies the segment. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.