Out-of-Scope Billing Flag

Spot in-flight work that is probably outside the client's agreement, flag it internally before
significant hours accumulate, and route it toward a quote/approval conversation instead of
unbilled delivery.

1. Read the ticket(s) in full — thread plus time entries. For a board/client sweep, search
   per client and note result caps.

2. Look for out-of-scope signals: new-project language (install, migrate, deploy, "set up the
   new office"), quantities (multiple machines/users at once), non-covered entities (a site,
   subsidiary, or personal device the requester says isn't on the agreement), and hours
   already logged well past typical incident size.

3. Check the coverage question honestly: Thread does not hold the agreement. If the requester
   provided scope terms (covered services, included users/sites, project threshold), test the
   signals against them and cite the specific term. If not, the output can only say "likely
   out of scope — verify against the agreement", never "not covered".

4. Quantify the exposure so far: hours already logged on the ticket, and a rough
   remaining-effort read from the thread.

5. Flag it: leave a plain-text internal note — signals found, hours logged to date, the
   agreement term in question (or "agreement not reviewed"), and the recommended path: pause
   non-urgent work, confirm scope with the account owner, quote if out of scope. With the
   requester's confirmation, change the ticket to the desk's scope-review status or board if
   one exists. Only two or more independent out-of-scope signals plus hours past incident size
   warrant a flag; one weak signal is not enough.

6. Output to the requester: the flag summary plus a suggested quote outline (what would be
   quoted, T&M vs fixed suggestion) they can hand to sales.

Guardrails: never state coverage as fact without citing the agreement evidence — "likely out
of scope" is the strongest claim allowed when the agreement hasn't been reviewed. Never tell
the client work is billable, paused, or requires a quote — that conversation belongs to a
human; all flags are internal notes. Do not stop or deprioritize urgent work (outages,
security) over a scope question; flag it and keep the client running — scope is settled after
stabilization. Confidence gate on status/board changes: only move the ticket when the
requester confirms; when running as a sweep, notes only. Time entries are the exposure
evidence — report logged hours as logged, no estimates dressed as actuals. When in doubt, do
nothing.