diff --git a/engagements/2026-08-21-audit-core-e2.json b/engagements/2026-08-21-audit-core-e2.json
index da34578..885103d 100644
--- a/engagements/2026-08-21-audit-core-e2.json
+++ b/engagements/2026-08-21-audit-core-e2.json
@@ -16,7 +16,7 @@
   "control_plane_scope": [
     "GET apps/v1 deployment audit-core/audit-core for target revision only",
     "GET v1 service audit-core/audit-core for target identity only",
-    "CREATE/GET/DELETE v1 pod user-engine/whitehat-e2-audit only",
+    "CREATE/GET/EXEC/DELETE v1 pod user-engine/whitehat-e2-audit only; EXEC may stream runners/audit_core_e2.py to python3 stdin and invoke no other program",
     "mount but never GET v1 secret user-engine/whitehat-e2-audit-credentials provisioned by the custody owner",
     "GET pod log user-engine/whitehat-e2-audit only"
   ],
diff --git a/engagements/runtime/audit-core-e2-pod.yaml b/engagements/runtime/audit-core-e2-pod.yaml
new file mode 100644
index 0000000..86b7acd
--- /dev/null
+++ b/engagements/runtime/audit-core-e2-pod.yaml
@@ -0,0 +1,47 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: whitehat-e2-audit
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine
+    app.kubernetes.io/component: whitehat-probe
+    whitehat.security/engagement: WH-ENG-20260821-AUDIT-E2
+spec:
+  automountServiceAccountToken: false
+  activeDeadlineSeconds: 900
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: probe
+      image: forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10
+      imagePullPolicy: IfNotPresent
+      command: ["sleep", "900"]
+      resources:
+        requests: {cpu: 5m, memory: 16Mi}
+        limits: {cpu: 50m, memory: 64Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+      volumeMounts:
+        - name: credentials
+          mountPath: /var/run/secrets/whitehat
+          readOnly: true
+  volumes:
+    - name: credentials
+      secret:
+        secretName: whitehat-e2-audit-credentials
+        defaultMode: 0440
+        items:
+          - key: token-a
+            path: token-a
+          - key: token-b
+            path: token-b