{"id":"GRD-019","section":"Runtime Guardrails","requirement":"Roll out policy in stages, starting in monitor-only mode","acceptance":"Start new policies in monitor-only mode, then escalate to coaching and blocking group by group. Policy changes reach every enforcement point within minutes, and every change is recorded with who made it, what changed and when.","tier":"AT0–AT4, AT6","whyItMatters":"Nobody should switch on blocking before seeing what monitoring finds.","verificationMethod":"W + POV","verificationTest":"A policy moves from monitor to coach to block for one pilot group; record how long changes take to apply.","formerly":"POL-007","alsoIn":[],"sort":29,"adoptionContext":"Policies reach employees across every listed context, so staged rollout should apply to each surface, not only the browser.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Staged rollout, fast propagation and a change record bring policy updates under configuration and change control. The buyer still sets the approval and review steps that decide when a group moves from monitoring to enforcement.","kind":"framework","references":{"csf":["PR.PS-01","ID.RA-07"],"soc2":["CC8.1"],"iso27001":["A.8.32","A.8.9"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Observing first and escalating by group is a planned, risk-based response to what monitoring finds. It is evidence of planned change; it does not decide on its own which response each risk needs.","kind":"framework","references":{"rmf":["MANAGE 1.3"],"iso":["Cl. 6.3"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-019","frameworkRefs":{"ISO27001":["A.8.32","A.8.9"],"ISO42001":["Cl. 6.3"],"NIST-CSF":["PR.PS-01","ID.RA-07"],"NIST-AI-RMF":["MANAGE 1.3"],"SOC2":["CC8.1"]}}