Acceptance criteria
Show differentiated rules for high-risk and trusted populations, beyond a blanket allow or block, including distinct treatment by approval state: approved, restricted, unapproved, personal, free and unauthorized use. Resolve users to approved identity attributes from the directory or HR system so rules and reports can key off department and role.
Why it matters
Different teams carry different risk. One rule for everyone is either too loose or too blunt.
How to verify
Two pilot groups get different outcomes for the same content, driven by directory attributes.
OWASP adoption context
User and business-context rules must follow employees across the listed AI settings; adoption tier alone is too coarse to decide authorization.
Framework mappings
Directory-resolved roles and other identity attributes let AI-use rules distinguish authorized populations, operations and destinations. This connects policy and identity context to contextual access decisions; showing differentiated rules alone does not demonstrate that access or data-transfer restrictions are enforced. ISO/IEC 27001: A.8.3: Restrictions must take effect before the operation. An attribute feed does not establish identity lifecycle management, and incorrect or stale HR/directory attributes can undermine policy.
Contextual rules and directory-resolved attributes support cybersecurity policy and access authorization. Test the resulting permissions in practice; consuming identity attributes does not manage identity or credential lifecycles.