Rules of engagement
Also known as RoE
The agreed conditions for a security test: timing, permitted techniques, escalation contacts, and stop conditions.
The rules cover when testing may run, whether denial of service or social engineering are permitted, who is told in advance, and who to call if something critical is found or something breaks.
It also includes written authorization from someone empowered to give it. Without that, the same activity is a crime rather than a service, which is why no reputable tester begins without it.
Where this comes up
Rules of engagement sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.