more legal and fix issues with types

ACCEPTABLE_USE.md

@@ -0,0 +1,73 @@
+# Acceptable Use Policy
+
+Overlord is intended for lawful administration, support, testing, and
+management of systems whose owners have given informed authorization.
+
+By using or distributing this project, you are responsible for complying with
+applicable law, contractual obligations, organizational policy, and the terms
+of every network and service involved.
+
+## Authorized use
+
+You may use Overlord for purposes such as:
+
+- Managing devices you own or are explicitly authorized to administer.
+- Providing remote support with the device owner's or organization's consent.
+- Operating an approved enterprise, laboratory, classroom, or homelab
+  environment.
+- Conducting a documented security assessment within its agreed scope.
+- Developing and testing defensive controls in an isolated environment.
+
+Authorization should identify the systems, accounts, operators, capabilities,
+data-handling rules, and time period in scope. An accessible device is not
+necessarily an authorized device.
+
+## Prohibited use
+
+Do not use Overlord to:
+
+- Access, monitor, control, enroll, or persist on a system without explicit
+  authorization.
+- Collect credentials, keystrokes, audio, video, files, communications, or
+  personal data without a lawful purpose and appropriate consent.
+- Conceal activity from a system owner or bypass required security,
+  privacy, monitoring, or consent controls.
+- Deploy malware, ransomware, destructive payloads, or unauthorized
+  cryptomining.
+- Exfiltrate, sell, publish, or misuse confidential or personal information.
+- Disrupt services, damage systems, interfere with other users, or evade
+  incident response.
+- Violate sanctions, export restrictions, intellectual-property rights, or
+  third-party service terms.
+- Help another person perform any prohibited activity.
+
+## Operator responsibilities
+
+Operators must:
+
+- Use individual accounts and least-privilege permissions.
+- Restrict agent enrollment and promptly revoke unauthorized or retired
+  clients.
+- Protect credentials, signing material, tokens, recordings, logs, and
+  transferred files.
+- Notify affected users and obtain consent where required.
+- Configure appropriate retention and securely delete data when it is no
+  longer needed.
+- Maintain audit records sufficient to attribute administrative actions.
+- Stop testing when it creates unexpected risk or exceeds the approved scope.
+
+## Plugins and modifications
+
+Plugins, custom builds, scripts, and downstream modifications remain subject
+to this policy. Their authors and operators are responsible for reviewing the
+additional permissions, data access, network behavior, and security impact
+they introduce.
+
+## Reporting misuse
+
+Report project security vulnerabilities according to
+[SECURITY.md](SECURITY.md). For suspected misuse, preserve relevant
+non-sensitive evidence and contact the service operator or appropriate
+authority. Do not publish credentials, tokens, personal data, or exploit
+details in a public issue.
+