# GRD-012: Apply policy by user, group, role, department, tool, account plan and risk context


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: POL-001
- URL: /r/GRD-012

**Acceptance criteria:** Show differentiated rules for high-risk and trusted populations, beyond a blanket allow or block, including distinct treatment by approval state: approved, restricted, unapproved, personal, free and unauthorized use. Resolve users to approved identity attributes from the directory or HR system so rules and reports can key off department and role.

**Why it matters:** Different teams carry different risk. One rule for everyone is either too loose or too blunt.

**How to verify:** Two pilot groups get different outcomes for the same content, driven by directory attributes.

**OWASP adoption context:** User and business-context rules must follow employees across the listed AI settings; adoption tier alone is too coarse to decide authorization.

**Mappings:**
- SOC 2: CC6.3, CC6.7; ISO 27001: A.8.3, A.5.15 — Directory-resolved roles and other identity attributes let AI-use rules distinguish authorized populations, operations and destinations. This connects policy and identity context to contextual access decisions; showing differentiated rules alone does not demonstrate that access or data-transfer restrictions are enforced.
ISO/IEC 27001: A.8.3: Restrictions must take effect before the operation. An attribute feed does not establish identity lifecycle management, and incorrect or stale HR/directory attributes can undermine policy.
- NIST CSF 2.0: GV.PO-01, PR.AA-05 — Contextual rules and directory-resolved attributes support cybersecurity policy and access authorization. Test the resulting permissions in practice; consuming identity attributes does not manage identity or credential lifecycles.