{"id":"PLT-001","section":"Platform, Privacy & Assurance","requirement":"Minimize endpoint and network architecture risk","acceptance":"Support agentless and optional-agent patterns, and avoid kernel mode, reverse proxy and major network changes unless justified and tested.","tier":"AT0–AT4","whyItMatters":"Kernel components, proxies and network changes add operational risk that should be justified.","verificationMethod":"D","verificationTest":"The vendor documents the deployment architecture and justifies any privileged component.","formerly":"ARC-006","alsoIn":[],"sort":55,"adoptionContext":"Endpoint and network design risks span the listed employee AI settings; broad coverage should not assume that one deployment architecture fits every surface.","mappings":[{"frameworks":["soc2","iso27001"],"explanation":"Justified, tested deployment choices provide secure-architecture, configuration and change/acceptance-review inputs and can reduce unnecessary privileged interception exposure. Agentless deployment is not intrinsically more secure, and these frameworks do not prohibit kernel components or reverse proxies.","kind":"framework","references":{"soc2":["CC6.1","CC8.1"],"iso27001":["A.8.27","A.8.29"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Agent choices and justified network changes document AI component controls, computing resources and deployment requirements. Tests provide readiness evidence, but the configuration still needs assessment in the actual deployment environment.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Justified and tested deployment choices provide readiness evidence when assessed against a defined deployment plan and acceptance criteria. Avoiding kernel components or reverse proxies is not itself resource documentation or proof of safe deployment.","kind":"framework","references":{"iso":["A.6.2.5"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Justified, tested deployment choices can provide configuration-acceptance evidence when assessed against a security baseline. Agentless deployment is not inherently safer, and avoiding a technology class does not establish a network-access safeguard.","kind":"framework","references":{"csf":["PR.PS-01"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-001","frameworkRefs":{"ISO27001":["A.8.27","A.8.29"],"ISO42001":["A.6.2.5"],"NIST-CSF":["PR.PS-01"],"NIST-AI-RMF":["MAP 4.2"],"SOC2":["CC6.1","CC8.1"]}}