{"id":"GRD-009","section":"Runtime Guardrails","requirement":"Detect proprietary source code and engineering content","acceptance":"Identify source code exposure across browser, IDE, desktop, CLI and agent workflows.","tier":"AT0–AT4","whyItMatters":"Source code is pasted into AI tools daily, across more surfaces than any other data type.","verificationMethod":"LT","verificationTest":"Proprietary code is detected in browser, IDE, CLI and agent use by pilot users.","formerly":"DAT-013","alsoIn":[],"sort":19,"adoptionContext":"Source code and engineering material can move through assistants, platforms and agent workflows as well as shadow tools; protection should follow the content.","mappings":[{"frameworks":["csf"],"explanation":"Code-exposure findings across browser, IDE, desktop, CLI and agent paths supply runtime-monitoring and in-transit protection inputs. Demonstrated detection coverage does not imply every transfer is stopped.","kind":"framework","references":{"csf":["PR.DS-02","DE.CM-09"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Source-code detection informs planned disclosure-risk responses and responsible-use rules across AI channels. The buyer still needs to select and operate the response.","kind":"framework","references":{"rmf":["MANAGE 1.3"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Identifying exposure of code designated confidential supplies inputs to confidentiality and leakage controls. It does not establish ownership, licensing compliance, repository access management or enforced prevention.\nSOC 2: C1.1: The Confidentiality category and relevant information must be in scope.\nISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.","kind":"framework","references":{"soc2":["C1.1","CC6.7"],"iso27001":["A.8.12"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Detecting source-code exposure supplies a specific input to responsible AI-use procedures across the supported channels. This link requires documented prohibited-input rules and an operated disposition; detection alone does not select or implement the response.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-009","frameworkRefs":{"ISO27001":["A.8.12"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.DS-02","DE.CM-09"],"NIST-AI-RMF":["MANAGE 1.3"],"SOC2":["C1.1","CC6.7"]}}