Ask Questions When Underspecified

When to Use

• A security review request lacks context about the threat model
• The scope of an audit or assessment is ambiguous
• Assumptions about trust boundaries need validation
• The deployment environment or architecture is unclear
• Risk tolerance or compliance requirements are not stated

When NOT to Use

• Context is already sufficient to proceed with analysis
• The task is purely mechanical (run a scan, parse output)
• Questions would block urgent incident response

Key Questions to Ask