{"id":"GRD-015","section":"Runtime Guardrails","requirement":"Coach employees in the moment","acceptance":"Show prompt-specific guidance naming the policy issue, and return the same feedback into developer tooling and MCP clients where the action originates there.","tier":"AT0–AT4, AT6","whyItMatters":"Coaching that names the issue and the safe alternative changes behavior; an unexplained block teaches nothing.","verificationMethod":"LT","verificationTest":"Pilot users see prompt-specific guidance with your policy links in the browser, IDE and MCP client.","formerly":"DAT-018","alsoIn":[],"sort":25,"adoptionContext":"In-the-moment guidance is relevant across employee AI and connected-agent use, wherever the interaction can present a meaningful warning or explanation.","mappings":[{"frameworks":["csf","soc2"],"explanation":"Prompt-specific guidance communicates the policy issue and an approved action where the employee is working. This contributes to policy awareness and competence development, but receiving a warning does not demonstrate competence or complete training.","kind":"framework","references":{"csf":["GV.PO-01","PR.AT-01"],"soc2":["CC2.2","CC1.4"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"In-context explanations of AI policy and safe actions contribute to AI-risk training, awareness and competence development. They must reach users in developer tools and MCP clients too; coaching alone does not demonstrate required competence.","kind":"framework","references":{"rmf":["GOVERN 2.2"],"iso":["Cl. 7.2","Cl. 7.3"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Delivered safe-action guidance is a security-awareness intervention at the decision point. A.6.3 needs guidance to reach relevant employees, including feedback from tools; recommendations alone are insufficient. Validate its reach and usefulness. A warning does not demonstrate competence or replace the wider awareness and training program.","kind":"framework","references":{"iso27001":["Cl. 7.3","A.6.3"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-015","frameworkRefs":{"ISO27001":["Cl. 7.3","A.6.3"],"ISO42001":["Cl. 7.2","Cl. 7.3"],"NIST-CSF":["GV.PO-01","PR.AT-01"],"NIST-AI-RMF":["GOVERN 2.2"],"SOC2":["CC2.2","CC1.4"]}}