diff --git a/engagements/2026-08-21-audit-core-e2.json b/engagements/2026-08-21-audit-core-e2.json
new file mode 100644
index 0000000..6fece37
--- /dev/null
+++ b/engagements/2026-08-21-audit-core-e2.json
@@ -0,0 +1,50 @@
+{
+  "engagement_id": "WH-ENG-20260821-AUDIT-E2",
+  "authorization_id": "operator-session-2026-08-21-e2-approval",
+  "authorizer": "repository operator and infrastructure owner",
+  "approved_at": "2026-08-21T21:56:00Z",
+  "expires_at": "2026-08-21T23:15:00Z",
+  "target": "http://audit-core.audit-core.svc.cluster.local:8080",
+  "target_owner": "audit-core / infrastructure operator",
+  "target_owner_acknowledged_at": "2026-08-21T21:56:00Z",
+  "environment": "production",
+  "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
+  "namespace": "audit-core",
+  "source": "dedicated attributed probe pod in an owner-approved ingress namespace",
+  "routes": [
+    "GET /readyz",
+    "POST /v1/events",
+    "GET /v1/events/{event_id}",
+    "GET /v1/events?correlation_id={correlation_id}"
+  ],
+  "fixture_ids": [
+    "tenant:trial:whitehat-a-20260821", "tenant:trial:whitehat-b-20260821",
+    "whitehat-e2-event-a-20260821", "whitehat-e2-event-b-20260821",
+    "whitehat-e2-absent-20260821", "whitehat-e2-correlation-20260821"
+  ],
+  "credential_lane": "audit-core sender registry through its sanctioned custody owner; no credential value retained",
+  "credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders",
+  "credential_max_ttl_seconds": 900,
+  "techniques": ["e2-differential"],
+  "prohibited_techniques": [
+    "discovery", "direct-database-access", "saturation", "large-payload",
+    "real-data-collection", "adjacent-service-follow-up"
+  ],
+  "rate_limit_per_minute": 10,
+  "max_concurrency": 1,
+  "maximum_requests": 30,
+  "window_start": "2026-08-21T23:00:00Z",
+  "window_end": "2026-08-21T23:15:00Z",
+  "operator_contact": "repository operator in coordinating session",
+  "abort_contact": "repository operator in coordinating session",
+  "abort_thresholds": {
+    "p95_latency_ms": 500,
+    "probe_attributable_5xx": 1,
+    "unexpected_or_non_fixture_data": 1,
+    "missing_attribution": 1
+  },
+  "posture_claim": "implemented E2; currently evidenced E1",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "finding_destination": "risk-nexus"
+}
+
diff --git a/engagements/2026-08-21-tenant-engine-e2.json b/engagements/2026-08-21-tenant-engine-e2.json
new file mode 100644
index 0000000..1d44278
--- /dev/null
+++ b/engagements/2026-08-21-tenant-engine-e2.json
@@ -0,0 +1,61 @@
+{
+  "engagement_id": "WH-ENG-20260821-TENANT-E2",
+  "authorization_id": "operator-session-2026-08-21-e2-approval",
+  "authorizer": "repository operator and infrastructure owner",
+  "approved_at": "2026-08-21T21:56:00Z",
+  "expires_at": "2026-08-21T22:35:00Z",
+  "target": "http://tenant-engine.tenant-engine.svc.cluster.local:8090",
+  "target_owner": "tenant-engine / infrastructure operator",
+  "target_owner_acknowledged_at": "2026-08-21T21:56:00Z",
+  "environment": "production",
+  "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
+  "namespace": "tenant-engine",
+  "source": "dedicated pod user-engine/whitehat-e2-tenant, labelled and attributed with this engagement id",
+  "routes": [
+    "GET /health",
+    "POST /tenants",
+    "GET /tenants/{tenant_id}",
+    "GET /tenants/{tenant_id}/roles",
+    "GET /tenants/{tenant_id}/roles/live",
+    "GET /tenants/{tenant_id}/guardrails",
+    "POST /tenants/{tenant_id}/roles/grant",
+    "POST /tenants/{tenant_id}/roles/revoke",
+    "POST /tenants/{tenant_id}/plan",
+    "PATCH /tenants/{tenant_id}",
+    "POST /tenants/{tenant_id}/retire",
+    "POST /tenants/{tenant_id}/reactivate",
+    "POST /tenants/{tenant_id}/grouping",
+    "PUT /tenants/{tenant_id}/guardrails/{limit_key}",
+    "DELETE /tenants/{tenant_id}/guardrails/{limit_key}"
+  ],
+  "fixture_ids": [
+    "whitehat-e2-a-20260821", "tenant:trial:whitehat-e2-a-20260821",
+    "whitehat-e2-b-20260821", "tenant:trial:whitehat-e2-b-20260821",
+    "whitehat-e2-absent-20260821"
+  ],
+  "credential_lane": "projected Kubernetes service identity from the existing user-engine ingress class; no credential value retained",
+  "credential_role": "ordinary user-engine caller with target-owner-confirmed flex-auth policy",
+  "credential_max_ttl_seconds": 900,
+  "techniques": ["e2-differential"],
+  "prohibited_techniques": [
+    "discovery", "direct-database-access", "saturation", "large-payload",
+    "real-data-collection", "adjacent-service-follow-up"
+  ],
+  "rate_limit_per_minute": 10,
+  "max_concurrency": 1,
+  "maximum_requests": 60,
+  "window_start": "2026-08-21T22:20:00Z",
+  "window_end": "2026-08-21T22:35:00Z",
+  "operator_contact": "repository operator in coordinating session",
+  "abort_contact": "repository operator in coordinating session",
+  "abort_thresholds": {
+    "p95_latency_ms": 500,
+    "probe_attributable_5xx": 1,
+    "unexpected_or_non_fixture_data": 1,
+    "missing_attribution": 1
+  },
+  "posture_claim": "implemented E2; currently evidenced E1",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "finding_destination": "risk-nexus"
+}
+