{"id":"GRD-012","section":"Runtime Guardrails","requirement":"Apply policy by user, group, role, department, tool, account plan and risk context","acceptance":"Show differentiated rules for high-risk and trusted populations, beyond a blanket allow or block, including distinct treatment by approval state: approved, restricted, unapproved, personal, free and unauthorized use. Resolve users to approved identity attributes from the directory or HR system so rules and reports can key off department and role.","tier":"AT0–AT4","whyItMatters":"Different teams carry different risk. One rule for everyone is either too loose or too blunt.","verificationMethod":"LT","verificationTest":"Two pilot groups get different outcomes for the same content, driven by directory attributes.","formerly":"POL-001","alsoIn":[],"sort":22,"adoptionContext":"User and business-context rules must follow employees across the listed AI settings; adoption tier alone is too coarse to decide authorization.","mappings":[{"frameworks":["soc2","iso27001"],"explanation":"Directory-resolved roles and other identity attributes let AI-use rules distinguish authorized populations, operations and destinations. This connects policy and identity context to contextual access decisions; showing differentiated rules alone does not demonstrate that access or data-transfer restrictions are enforced.\nISO/IEC 27001: A.8.3: Restrictions must take effect before the operation. An attribute feed does not establish identity lifecycle management, and incorrect or stale HR/directory attributes can undermine policy.","kind":"framework","references":{"soc2":["CC6.3","CC6.7"],"iso27001":["A.8.3","A.5.15"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Contextual rules and directory-resolved attributes support cybersecurity policy and access authorization. Test the resulting permissions in practice; consuming identity attributes does not manage identity or credential lifecycles.","kind":"framework","references":{"csf":["GV.PO-01","PR.AA-05"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-012","frameworkRefs":{"ISO27001":["A.8.3","A.5.15"],"NIST-CSF":["GV.PO-01","PR.AA-05"],"SOC2":["CC6.3","CC6.7"]}}