{"id":"GRD-010","section":"Runtime Guardrails","requirement":"Support granular custom detections","acceptance":"Let authorized teams maintain custom keywords, client and project identifiers and deal codenames, with an audit trail.","tier":"AT0–AT4","whyItMatters":"Built-in models cannot know your client names, project codes or deal codenames.","verificationMethod":"W","verificationTest":"An authorized user adds a project codename and it is detected in the next pilot prompt, with the change audited.","formerly":"DAT-007","alsoIn":[],"sort":20,"adoptionContext":"Customer, project and deal vocabulary can appear across the listed employee AI settings, so custom detections should follow that vocabulary rather than one product.","mappings":[{"frameworks":["iso"],"explanation":"The audit trail of custom-detection changes supplies AI event-record evidence. It does not establish complete logging coverage, retention or record protection.","kind":"framework","references":{"iso":["A.6.2.8"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Custom detections tailor leakage rules to company information, while their audit trail records administrative changes. Detection still needs a protective disposition, and the trail alone does not demonstrate change testing and approval.\nISO/IEC 27001: A.8.15: Keep attributable records with appropriate retention, protection and analysis; a live view alone is insufficient. A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Enforce authorization; keywords cannot replace a complete information inventory or semantic detection.","kind":"framework","references":{"soc2":["CC6.7","CC8.1"],"iso27001":["A.8.15","A.8.12"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Custom client, project and codename detections configure a specific sensitive-data signal for protecting AI submissions. Use those detections in an operated leakage-protection workflow; a detector vocabulary is not an inventory of data holdings.","kind":"framework","references":{"csf":["PR.DS-02"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-010","frameworkRefs":{"ISO27001":["A.8.15","A.8.12"],"ISO42001":["A.6.2.8"],"NIST-CSF":["PR.DS-02"],"SOC2":["CC6.7","CC8.1"]}}