Clients, engagements, assets

Client

A client is a company you test for. It carries a display name (how it appears in the interface), a legal name, an active flag, an optional logo, and a set of contacts. A contact has a name, role, email and phone, and can be marked an authorizer: authorizers are the people who signed off on the test window and appear on the report cover. A client cannot be deleted while any engagement still references it.

Engagement

An engagement is one pentest against a client. Its code is assigned by the server in YEAR-SEQ form and never changes. It carries a title, a test window (start and end), an optional lead, source IPs that appear on the report, its members (the accounts allowed to work it), and the methodology frameworks adopted for it.

The engagement's status is an explicit lifecycle: planning, in_progress, reporting, closed. Much of the portfolio view (the Panel) reads this status directly rather than guessing it. Access to an engagement is scoped: a member sees the engagements they belong to, an administrator sees all, and every query that touches engagement data enforces that scope rather than trusting a check a screen could forget.

Asset

An asset is a system in scope for the engagement, of a kind (web, REST API, and so on). Coverage and findings are recorded against assets, so an asset with any published finding cannot be deleted without losing that history, which PEART refuses. Assets are where the methodology meets the real target: you work each technique against each asset, and record the result as coverage.