{"id":"AUD-003","section":"Audit & Evidence","requirement":"Restrict and audit access to raw prompt content","acceptance":"Provide RBAC controls over who can read full prompt content, and record each access to it.","tier":"Tier-independent","whyItMatters":"Raw prompts are among the most sensitive data the control holds, so access must be limited and logged.","verificationMethod":"W","verificationTest":"Only an authorized role can open full prompt content, and each access is recorded.","formerly":"GOV-005","alsoIn":["platform"],"sort":54,"adoptionContext":"Raw prompt access needs protection across the listed employee AI settings, independently of whether the underlying application is sanctioned.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Role-scoped access restricts who can read raw prompts, helping protect stored content, while records of each read supply monitoring evidence. Restrictions must operate across relevant access paths; logged reads still require review and follow-up to detect misuse.\nISO/IEC 27001: Enforce restrictions before access across the UI, exports, APIs, search and administrators. Retain, protect and analyze attributed access logs; logging access does not authorize it.","kind":"framework","references":{"csf":["PR.AA-05","PR.DS-01"],"soc2":["CC6.3","CC7.2"],"iso27001":["A.8.3","A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Restricted and recorded access to identifiable prompt content provides evidence of a treatment for privacy risk. The broader examination and documentation of privacy impacts remain necessary.","kind":"framework","references":{"rmf":["MEASURE 2.10"]},"relation":null,"conditions":[]}],"area":"Audit & Evidence","areaSlug":"AUD","url":"/r/AUD-003","frameworkRefs":{"ISO27001":["A.8.3","A.8.15"],"NIST-CSF":["PR.AA-05","PR.DS-01"],"NIST-AI-RMF":["MEASURE 2.10"],"SOC2":["CC6.3","CC7.2"]}}