Lab Mode and Scope Bypass

Lab mode and scope bypass define the explicit exception path for cases where normal scope enforcement is intentionally suspended.

1. Problem this page solves

Normal governed execution assumes scope checks pass before execution. Some lab and test scenarios require controlled exceptions, and those exceptions must be recorded without being confused for normal governed production evidence.

2. What you should understand after reading

After this page, you should understand:

• when lab mode is allowed
• what --lab and --no-scope mean in practice
• what must be documented before and after exception use
• what a bypassed receipt can and cannot prove

3. Mechanism-first exception path

1. Declare the exception intent. Document the lab objective and why normal scope enforcement is not enough.
2. Constrain the exception boundary. Set the target boundary, environment class, and stop condition explicitly.
3. Authorize the exception. A named approver accepts the elevated risk posture.
4. Execute with explicit markers. --lab marks a lab run; --no-scope bypasses scope enforcement when required.
5. Record exception evidence. The receipt and evidence chain must show lab status and bypass state clearly.
6. Interpret the trust posture correctly. A bypassed run is exception evidence, not normal governed scope-compliant evidence.

See Commands for command-reference details.

4. Required controls and evidence fields

Before running with lab mode or scope bypass, define:

• why normal scope enforcement is not enough
• the exact target boundary
• the named approver for the exception risk
• the environment classification (lab, sandbox, demo, isolated test)
• the stop condition for unintended scope or data impact

The evidence record must show:

• lab marker present
• bypass state present
• approver and reason present
• intended target boundary present
• sensitive-data handling state present

In the current receipt model, scope_validated: false means normal scope enforcement did not apply.

5. Observed vs inferred

6. Trust assumptions and hard-fail boundaries

Lab mode is not a speed shortcut. It is an explicit trust-posture downgrade with stricter documentation requirements.

Hard-fail examples:

• bypass without a named approver
• lab run claimed against a production target without explicit written exception
• exception run later represented as normal governed scope-compliant evidence
• sensitive artifact collection without a handling plan

A bypassed receipt can still prove that a run occurred and that artifacts were linked. It cannot prove that normal scope controls were satisfied.

7. Next-page handoff

Next, read Operations to see how governed workflows, runbooks, and operator controls handle these governance boundaries in execution practice.

Then use Authorization Model and Threat Model for authority and boundary depth.