# Acceptable Use Policy

Overlord is intended for lawful administration, support, testing, and
management of systems whose owners have given informed authorization.

By using or distributing this project, you are responsible for complying with
applicable law, contractual obligations, organizational policy, and the terms
of every network and service involved.

## Authorized use

You may use Overlord for purposes such as:

- Managing devices you own or are explicitly authorized to administer.
- Providing remote support with the device owner's or organization's consent.
- Operating an approved enterprise, laboratory, classroom, or homelab
  environment.
- Conducting a documented security assessment within its agreed scope.
- Developing and testing defensive controls in an isolated environment.

Authorization should identify the systems, accounts, operators, capabilities,
data-handling rules, and time period in scope. An accessible device is not
necessarily an authorized device.

## Prohibited use

Do not use Overlord to:

- Access, monitor, control, enroll, or persist on a system without explicit
  authorization.
- Collect credentials, keystrokes, audio, video, files, communications, or
  personal data without a lawful purpose and appropriate consent.
- Conceal activity from a system owner or bypass required security,
  privacy, monitoring, or consent controls.
- Deploy malware, ransomware, destructive payloads, or unauthorized
  cryptomining.
- Exfiltrate, sell, publish, or misuse confidential or personal information.
- Disrupt services, damage systems, interfere with other users, or evade
  incident response.
- Violate sanctions, export restrictions, intellectual-property rights, or
  third-party service terms.
- Help another person perform any prohibited activity.

## Operator responsibilities

Operators must:

- Use individual accounts and least-privilege permissions.
- Restrict agent enrollment and promptly revoke unauthorized or retired
  clients.
- Protect credentials, signing material, tokens, recordings, logs, and
  transferred files.
- Notify affected users and obtain consent where required.
- Configure appropriate retention and securely delete data when it is no
  longer needed.
- Maintain audit records sufficient to attribute administrative actions.
- Stop testing when it creates unexpected risk or exceeds the approved scope.

## Plugins and modifications

Plugins, custom builds, scripts, and downstream modifications remain subject
to this policy. Their authors and operators are responsible for reviewing the
additional permissions, data access, network behavior, and security impact
they introduce.

## Reporting misuse

Report project security vulnerabilities according to
[SECURITY.md](SECURITY.md). For suspected misuse, preserve relevant
non-sensitive evidence and contact the service operator or appropriate
authority. Do not publish credentials, tokens, personal data, or exploit
details in a public issue.