{"id":"GRD-002","section":"Runtime Guardrails","requirement":"Inspect file uploads before submission","acceptance":"Apply eligible detection models to uploaded files, summarize the alert, and document coverage differences between files and typed text.","tier":"AT0–AT3","whyItMatters":"Files carry far more data than typed prompts, and many tools treat uploads as a separate, weaker path.","verificationMethod":"LT","verificationTest":"Sensitive DOCX, PDF, XLSX and CSV uploads are inspected before submission; coverage differences are documented.","formerly":"DAT-005","alsoIn":[],"sort":12,"adoptionContext":"The listed shadow, assistant, platform and citizen-workflow contexts cover common upload paths; file-inspection support must be demonstrated for each eligible surface.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"File inspection extends disclosure-detection inputs to uploads before submission. Alert summaries and file-versus-text coverage limits support transfer decisions, but inspection alone does not stop a prohibited upload.\nISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Make unsupported formats, encryption and parser limits visible.","kind":"framework","references":{"csf":["PR.DS-02"],"soc2":["CC6.7"],"iso27001":["A.8.12"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Documented file-versus-text coverage differences inform the scope and limits of planned AI risk responses. They do not establish that an effective response is applied to every upload.","kind":"framework","references":{"rmf":["MANAGE 1.3"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Inspecting uploaded files provides a detection stage in an AI-input-use procedure. This link requires documented rules for prohibited input and an operated disposition for findings; inspection and alert summaries alone do not establish the whole procedure.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-002","frameworkRefs":{"ISO27001":["A.8.12"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.DS-02"],"NIST-AI-RMF":["MANAGE 1.3"],"SOC2":["CC6.7"]}}