A municipal playbook stores wordlists on the assessment host. What statement best separates toolchain preparation from illegal targeting?

Wordlists on an assessment host support offline passphrase testing in authorized labs; possessing rockyou-class lists does not authorize attacking neighboring networks or expanding RoE. Municipal playbooks store wordlists as toolchain preparation for in-scope WPA2-Personal evaluations, cleanly separated from illegal or out-of-scope targeting. That separation is an ethical and operational boundary civic assessors must articulate clearly. Saying any host with rockyou.txt may legally crack every open café SSID on the channel fails by concept: legality and authorization are scope-bound, not wordlist-bound. Claiming storing a wordlist automatically expands RoE to all discovered BSSIDs fails by concept: RoE expansion requires explicit permission, not file presence. Asserting wordlists are only for Enterprise certificate forging and never apply to Personal PSK labs fails by concept: wordlists are classically used for PSK offline guessing in authorized Personal assessments. Exam caveat: even in-scope offline cracking should follow evidence handling—label caps, avoid attacking unintended BSS handshakes captured incidentally. Operational check: keep wordlists on the engagement host, use them only against authorized captures, document which list and rules produced a finding, and never point aircrack-ng at out-of-scope networks “because the list was already there.”