{"id":"GRD-018","section":"Runtime Guardrails","requirement":"Turn acceptable-use policy into enforceable scenarios","acceptance":"Express AUP rules as policies and demonstrate enforcement.","tier":"AT0–AT4","whyItMatters":"An acceptable-use policy only matters if it can be enforced and shown to be enforced.","verificationMethod":"W + POV","verificationTest":"Three clauses from your AUP are expressed as policies and successfully tested in your pilot.","formerly":"GOV-007","alsoIn":["audit"],"sort":28,"adoptionContext":"Acceptable-use rules need concrete scenarios across the listed employee AI contexts rather than a policy that only addresses one application type.","mappings":[{"frameworks":["csf","iso","soc2","iso27001"],"explanation":"Translating approved acceptable-use rules into executable scenarios connects organizational policy to responsible-use procedures and practical restrictions. Would-have-fired and actual-action records help evaluate implementation; simulation alone does not demonstrate operational enforcement, policy communication or a completed periodic compliance review.","kind":"framework","references":{"csf":["GV.PO-01"],"iso":["A.2.2","A.9.2"],"soc2":["CC5.3","CC4.1"],"iso27001":["Cl. 8.1","A.5.10","A.5.36"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Executable acceptable-use scenarios and their results help operationalize trustworthy-AI characteristics in organizational policy and practice. Coverage depends on which characteristics the approved rules actually address.","kind":"framework","references":{"rmf":["GOVERN 1.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-018","frameworkRefs":{"ISO27001":["Cl. 8.1","A.5.10","A.5.36"],"ISO42001":["A.2.2","A.9.2"],"NIST-CSF":["GV.PO-01"],"NIST-AI-RMF":["GOVERN 1.2"],"SOC2":["CC5.3","CC4.1"]}}