A program invitation lands in your inbox. It names the client, lists the target systems, sets the rules of engagement, and states the legal authority under which you may test. Until you have read and understood that document, you have nothing you are allowed to do. In bug bounty work, the scope (the list of assets you may test) and the rules of engagement (the limits on how you may test them) are what separate authorized research from unauthorized access.
A bug bounty program is a published offer. The organization states what it wants tested, how, and what it will do with your findings. Your acceptance of those terms is your written authorization. Any work outside them has no legal cover.
Every engagement rests on four things:
Here is the brief from Northbridge Health SaaS, a company with 1,200 employees that hosts patient-facing software. Read for the boundaries first, and note where the data handling line sits.
This course follows one path, and each phase produces something the next one needs. Scope decisions feed reconnaissance. Reconnaissance feeds classification of what you find. Classification guides what evidence you collect, and evidence supports your severity rating and your report. Coordination with the vendor closes the loop. Here is how those phases and their outputs line up for the Northbridge Health SaaS program: