# Acceptable Use Policy
# Cold Bore Ballistics LLC — Internal Reference
# Classification: Confidential

Subordinate to: `CBB_Information_Security_Policy.md` §12

---

## 1. Purpose and Scope

This policy defines acceptable and unacceptable use of CBB systems, accounts, data, and tools. It applies to all employees, contractors, and AI-assisted tooling with access to CBB systems or data.

---

## 2. Account Use

### 2.1 CBB accounts for CBB work

All CBB work must be conducted using CBB accounts (`@coldboreballisticsllc.com`). Personal accounts must never be used for CBB work, including:

- Accessing or storing CBB data
- Communicating on behalf of CBB
- Registering for CBB-related services
- Receiving CBB credentials or secrets

### 2.2 Personal recovery credentials

`jason.schwefel78@gmail.com` is designated as a personal recovery account only. It must never be used for any CBB service, communication, or work purpose. If a personal recovery account is needed for a CBB service as a fallback, stop and consult the Global Administrator — never assume a personal account is acceptable.

### 2.3 No account sharing

CBB accounts must not be shared between individuals. Each person and each integration receives its own uniquely identified account. See `Access_Control_Policy.md` §4.

### 2.4 Break-glass accounts

The break-glass Global Administrator account (`admin@coldboreballistics.onmicrosoft.com`) must not be used for routine work. Its use is restricted to emergency recovery situations where the primary Global Administrator account is inaccessible.

---

## 3. Device Use

### 3.1 CBB data on personal devices

CBB Confidential and Highly Confidential data must not be stored on personal devices (phones, personal laptops, personal cloud storage) without explicit written approval from the Global Administrator.

Tier 1 (Public) and Tier 2 (General) data may be accessed on personal devices for routine work purposes.

### 3.2 Device security baseline

Any device used to access CBB systems must:

- Have a screen lock enabled with a PIN, password, or biometric
- Have full-disk encryption enabled where the OS supports it (FileVault on macOS, BitLocker on Windows, LUKS on Linux)
- Have OS and security patches applied within a reasonable time of release

### 3.3 Lost or stolen devices

A lost or stolen device with access to CBB systems must be reported to the Global Administrator immediately. Remote wipe will be initiated for enrolled devices. All sessions accessible from the device will be revoked.

---

## 4. Data Handling

### 4.1 Correct storage location

CBB data must be stored in its correct OneDrive tier. Storing data in a lower-classification tier than its content requires (e.g., saving a Confidential document in a Public directory) is a policy violation.

### 4.2 No unauthorized copies

Confidential and Highly Confidential data must not be copied to unauthorized locations — including but not limited to personal cloud storage (Google Drive, Dropbox, personal OneDrive), personal email, or USB drives.

### 4.3 No public disclosure of restricted content

Confidential and Highly Confidential content must not be quoted, summarized, or referenced in:

- Public git repositories or commits
- Public Jira or GitHub issues
- Slack channels with external members
- Any external communication without a signed NDA in place

---

## 5. AI-Assisted Tooling

### 5.1 CBB credentials for AI tools

AI agents and automation (e.g., Claude Code operating under `claude-code-*` app registrations) are subject to all policies in this suite. Credentials issued to AI tooling must follow the same least-privilege and single-purpose requirements as credentials issued to humans.

### 5.2 Scope discipline

AI tooling must operate only within the scope of its stated purpose and its issued credentials. An AI agent must not use a credential to access a system or data beyond what that credential's purpose authorizes — even if the credential technically permits it. Scope violations are security incidents per `Incident_Response_Policy.md` §2.

### 5.3 No Highly Confidential data in AI prompts

Tier 4 (Highly Confidential) data — specifically the SPEC, engine internals, and DOPE-Blend™ methodology — must not be included in AI tool prompts or inputs that are transmitted to external AI services. This data must remain within CBB-controlled systems at all times.

### 5.4 External AI services

Use of external AI services (Anthropic, OpenAI, Google, etc.) for CBB work is permitted for Tier 1 (Public) and Tier 2 (General) data. Tier 3 (Confidential) data may be used with AI services only when the service is covered by a current Security Review. Tier 4 (Highly Confidential) data must never be submitted to any external AI service.

---

## 6. Communications

### 6.1 Channel appropriateness

CBB uses Slack (`coldboreballisticsllc.slack.com`) as its primary internal communications platform. Confidential information shared in Slack must be shared in private channels or direct messages — never in channels with external members or guests.

### 6.2 Email

CBB work email uses M365 (`@coldboreballisticsllc.com`). Confidential or Highly Confidential data must not be sent via email to external parties without a signed NDA in place and explicit approval from the Global Administrator.

### 6.3 No personal email for CBB business

Personal email accounts must never be used to send, receive, or store CBB data. This includes forwarding CBB email to personal accounts for convenience.

---

## 7. Software and Services

### 7.1 Approved tools

Individuals must use CBB-approved tools and services for work that involves CBB data. Introducing a new tool that will access Confidential data requires a Security Review per `Vendor_and_Third_Party_Policy.md` §3.

### 7.2 No unauthorized software on CBB systems

Software that is not required for an individual's stated role must not be installed on CBB-managed servers or infrastructure. This applies to browser extensions, monitoring tools, and any software that could exfiltrate data or create unauthorized access paths.

---

## 8. Violations

Violations of this policy must be reported to the Global Administrator. Violations may result in:

- Immediate revocation of access
- Termination of employment or contractor engagement
- Legal action where warranted

Individuals who discover a violation — including a violation by an AI tool — must report it per `Incident_Response_Policy.md` §4.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Security/Acceptable_Use_Policy.md` |
| **Cross-references** | `CBB_Information_Security_Policy.md`; `Access_Control_Policy.md`; `Data_Classification_Policy.md`; `Vendor_and_Third_Party_Policy.md`; `Incident_Response_Policy.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
| DRAFT | 2026-06-09 | Claude Code | — | — | Removed non-standard `# Last Updated` header line (per TECHNICAL_DOCUMENTATION_GUIDE §7). No content changes. |
