A city sudo package is old with known public issues, but the rules of engagement ban using public exploits without approval. What is the correct next judgment?

If a city sudo package is old with known public issues but RoE bans using public exploits without approval, the correct judgment is to respect RoE: seek explicit approval or prefer in-scope manual misconfiguration paths rather than unapproved public exploit use against production civic hosts.

CVE numbers do not override client contracts. Deleting the sudo binary to force patching is destructive and unauthorized. Publishing an unapproved exploit against production before notifying anyone violates professional and legal norms.

Exam caveat: documenting the outdated package as a finding can proceed even when exploit execution is deferred pending approval.

Operational check: record package version and advisory references, request written approval if exploit validation is needed, and pursue sudoers/misconfig proofs that stay inside standing authorization for the city engagement. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.