A school-district purple team packages adversary emulation as CI jobs that may run only on labeled lab runners. What constraint does that enforce?

School-district purple teams that package adversary emulation as CI jobs allowed only on labeled lab runners are constraining execution placement. Runner labels/tags ensure offensive workflows land on authorized lab agents—not available build agents including general production runners, which would expose production systems to emulation effects without isolation, consent, or appropriate monitoring. Placement control prevents accidental execution in environments that lack isolation, consent, or monitoring appropriate for emulation.

The correct constraint works because CI convenience is dangerous without affinity rules. Without labels, a misconfigured job can schedule onto whatever agent is free, including production builders that touch student information systems.

Constraining artifact signing workflows so they execute only on authorized labeled lab runners, not general production build agents fails because it names the wrong workflow — artifact signing is an integrity control, not adversary emulation, and restricting it to the lab does not constrain where offensive CI jobs run.

Constraining deployment approval workflows so they execute only on authorized labeled lab runners, not general production build agents fails because it describes approval governance, not emulation placement — it does not limit automated offensive workflows to isolated lab infrastructure.

Constraining secrets rotation workflows so they execute only on authorized labeled lab runners, not general production build agents fails because secrets rotation is credential lifecycle hygiene, not offensive execution — applying lab-only placement to rotation leaves the emulation jobs unconstrained.

Exam caveat: “Labeled lab runners only” is about where offensive automation executes—not constraining artifact signing workflows, deployment approval workflows, or secrets rotation workflows to lab runners.

Operational check: Require runner labels in the CI job YAML, deny unlabeled agents, and periodically inventory which hosts carry the lab label versus production build pools.