# GRD-019: Roll out policy in stages, starting in monitor-only mode


- Area: Runtime Guardrails

- Verification: Walkthrough + Proof of value
- OWASP adoption tier: AT0–AT4, AT6
- Formerly: POL-007
- URL: /r/GRD-019

**Acceptance criteria:** Start new policies in monitor-only mode, then escalate to coaching and blocking group by group. Policy changes reach every enforcement point within minutes, and every change is recorded with who made it, what changed and when.

**Why it matters:** Nobody should switch on blocking before seeing what monitoring finds.

**How to verify:** A policy moves from monitor to coach to block for one pilot group; record how long changes take to apply.

**OWASP adoption context:** Policies reach employees across every listed context, so staged rollout should apply to each surface, not only the browser.

**Mappings:**
- NIST CSF 2.0: PR.PS-01, ID.RA-07; SOC 2: CC8.1; ISO 27001: A.8.32, A.8.9 — Staged rollout, fast propagation and a change record bring policy updates under configuration and change control. The buyer still sets the approval and review steps that decide when a group moves from monitoring to enforcement.
- NIST AI RMF: MANAGE 1.3; ISO 42001: Cl. 6.3 — Observing first and escalating by group is a planned, risk-based response to what monitoring finds. It is evidence of planned change; it does not decide on its own which response each risk needs.