{"id":"GRD-021","section":"Runtime Guardrails","requirement":"Keep typical added inline latency under 300 ms","acceptance":"State the added policy-decision latency and the conditions it was measured under, and document the behavior when a decision is slow or unavailable, including whether the control fails open or closed.","tier":"AT0–AT4","whyItMatters":"Added delay decides whether real-time enforcement is practical or only theoretical.","verificationMethod":"LT","verificationTest":"Record the added decision time on pilot prompts and the behavior when a decision is slow.","formerly":"ARC-013","alsoIn":[],"sort":31,"adoptionContext":"The listed assistant, platform and agent contexts can place controls inline with work, making added latency and failure behavior important deployment tests.","mappings":[{"frameworks":["soc2"],"explanation":"Measured policy-decision latency and documented slow/unavailable behavior provide operational-design and disruption-planning inputs. The buyer must assess fail-open/fail-closed trade-offs; a latency number alone establishes neither adequate capacity nor acceptable risk, and 300 ms is not a framework threshold.","kind":"framework","references":{"soc2":["CC9.1"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Latency results under stated test conditions provide performance-measurement evidence for evaluating AI operation against chosen objectives. The buyer must judge deployment relevance and acceptable failure behavior; documentation alone does not demonstrate performance under every operating condition.","kind":"framework","references":{"rmf":["MEASURE 2.3"],"iso":["Cl. 9.1"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Measured policy-decision delay and documented slow or unavailable behavior provide security-control performance and operational-design evidence. Define the measurement method, responsibility, cadence and evaluation, and adopt acceptable failure criteria. ISO sets no 300 ms target; a latency number does not establish capacity or acceptable fail-open risk.","kind":"framework","references":{"iso27001":["Cl. 9.1","Cl. 8.1"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Documented slow or unavailable behavior, including fail-open or fail-closed choices, informs resilience design. Test the behavior under adverse conditions and assess its acceptability; a latency measurement alone does not establish resource capacity.","kind":"framework","references":{"csf":["PR.IR-03"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-021","frameworkRefs":{"ISO27001":["Cl. 9.1","Cl. 8.1"],"ISO42001":["Cl. 9.1"],"NIST-CSF":["PR.IR-03"],"NIST-AI-RMF":["MEASURE 2.3"],"SOC2":["CC9.1"]}}