# GRD-018: Turn acceptable-use policy into enforceable scenarios


- Area: Runtime Guardrails

- Verification: Walkthrough + Proof of value
- OWASP adoption tier: AT0–AT4
- Formerly: GOV-007
- URL: /r/GRD-018

**Acceptance criteria:** Express AUP rules as policies and demonstrate enforcement.

**Why it matters:** An acceptable-use policy only matters if it can be enforced and shown to be enforced.

**How to verify:** Three clauses from your AUP are expressed as policies and successfully tested in your pilot.

**OWASP adoption context:** Acceptable-use rules need concrete scenarios across the listed employee AI contexts rather than a policy that only addresses one application type.

**Mappings:**
- NIST CSF 2.0: GV.PO-01; ISO 42001: A.2.2, A.9.2; SOC 2: CC5.3, CC4.1; ISO 27001: Cl. 8.1, A.5.10, A.5.36 — Translating approved acceptable-use rules into executable scenarios connects organizational policy to responsible-use procedures and practical restrictions. Would-have-fired and actual-action records help evaluate implementation; simulation alone does not demonstrate operational enforcement, policy communication or a completed periodic compliance review.
- NIST AI RMF: GOVERN 1.2 — Executable acceptable-use scenarios and their results help operationalize trustworthy-AI characteristics in organizational policy and practice. Coverage depends on which characteristics the approved rules actually address.