{"id":"GRD-016","section":"Runtime Guardrails","requirement":"Explain each decision to the employee and the analyst","acceptance":"Show which detection or policy triggered and highlight the content that caused it, both in the employee's coaching message and in the analyst's alert, so the employee can fix the prompt and the analyst can confirm the decision without opening another tool.","tier":"AT0–AT4","whyItMatters":"Explaining the trigger lets the employee fix the prompt and the analyst confirm the decision, which cuts tickets on both sides.","verificationMethod":"LT","verificationTest":"The coaching message and the alert both show the detection that fired and highlight the content.","formerly":"DAT-020","alsoIn":["aidr"],"sort":26,"adoptionContext":"Employees and analysts meet these decisions in every listed context, so explanations should appear wherever the intervention does.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Naming the trigger and the content behind it gives analysts what they need to evaluate an event and gives employees specific, in-context awareness of the policy. Explanations must not expose more sensitive content than the viewer is entitled to see.","kind":"framework","references":{"csf":["DE.AE-02","PR.AT-01"],"soc2":["CC2.2","CC7.3"],"iso27001":["A.5.25","A.6.3"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Showing why a detection fired explains the control's output to the people it affects and documents how the decision was reached. It explains the decision, not the internal workings of the detection model.","kind":"framework","references":{"rmf":["MEASURE 2.9"],"iso":["A.8.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-016","frameworkRefs":{"ISO27001":["A.5.25","A.6.3"],"ISO42001":["A.8.2"],"NIST-CSF":["DE.AE-02","PR.AT-01"],"NIST-AI-RMF":["MEASURE 2.9"],"SOC2":["CC2.2","CC7.3"]}}