Deception with explicit scope

Honeypots placed where production teams expect them — useful signal without surprise assets.

Decoys are documented in authorization records and change windows. SOC sees lateral movement attempts with context, not mystery hosts.