A county IR lead insists emulation chains stop before impact and always page change control. Which principle is being applied?

A county IR lead who insists emulation chains stop before impact and always page change control is applying safety and change-control gates so chained offensive behaviors never reach destructive impact without authorization. Municipal purple teaming validates detection and response up to a safe boundary; impact actions (encryption, wipe, sabotage) require separate, explicit approval if allowed at all. Paging change control keeps operations and IR deconflicted during chained runs. Recording safety gate decisions and change-control approvals for chained behaviors in impact documentation for review supports auditability and review, but it does not address the IR lead's actual principle — stopping chained behavior before destructive impact and paging change control — so it answers a different governance question than the one the stem describes. Mapping chained offensive behaviors to MITRE ATT&CK techniques to validate coverage for impact reporting after authorization addresses coverage and documentation, but it does not implement the stop-before-impact safety gate or the change-control page required by the stem, so it does not match the principle being applied. Coordinating emulation windows with system owners through change-control so safety checks limit impact to business operations helps coordinate timing and limit disruption, but it is a scheduling control rather than the mandatory stop-before-impact gate and change-control notification described in the stem. Exam caveat: “before impact” must be defined in the playbook (which ATT&CK impact techniques are forbidden), and emergency abort paths must work even if automation continues after a missed page. Operational check: encode stop-before-impact in the chain, require change-control notification before execution, verify IR acknowledges the page, and confirm no encrypt/wipe/delete actions run unless a separate authorized DR test is explicitly scoped.