# Tutorial: choose your deception use case

Before you open compose profiles or plant tokens, pick a primary use case.
This gate keeps language and sign-off aligned with the
[NCSC-oriented strategy](../explanation/deception-strategy.md).

**Time:** ~5 minutes.

## Step 1: Pick one

| I want… | Choose | Next |
|---------|--------|------|
| Early warning when secrets leave corp hosts | **Tripwires** | Ops → Manage → Canaries; issue with owner / blast-radius / TTL |
| Attacker observation / CTI from a decoy host | **Honeypot** | [Progressive onboarding](../how-to/progressive-onboarding.md) Level 1 (loopback) |
| Lures that steer attackers into instrumented decoys | **Breadcrumbs** | Strategy page + blast-radius checklist; planter packs in later phases |

Glossary: [deception-glossary.md](../reference/deception-glossary.md).

## Step 2: Privacy and blast-radius before exposure

1. Skim the [privacy pack](../compliance/privacy-pack.md) (lawful interest / retention).
2. For any canary or shared-infra plant, complete
   [production-signoff governance](../how-to/production-signoff-governance.md)
   (owner, TTL, blast-radius, IT/DevOps owner when shared).
3. Confirm Internet-bind is still **NOT CLEARED** unless your org closed every
   residual in [production-signoff](../assurance/production-signoff.md).

## Step 3: Lab first

Default path: Contained on loopback (`127.0.0.1`). Do not publish attacker-facing
ports until purple-team / A8 / production-signoff say GO for your profile.

```bash
# Contained research sensor (loopback): see progressive onboarding
./bin/sensor   # or docker run with loopback publish only
```

## Done when

- [ ] Use case chosen and recorded in your engagement notes
- [ ] Glossary terms used consistently (tripwire / honeypot / breadcrumb)
- [ ] Privacy + blast-radius checklist started before any non-loopback bind