{"id":"PLT-002","section":"Platform, Privacy & Assurance","requirement":"Disclose where decisions are enforced and how the control fails","acceptance":"Enforce before submission, so a blocked payload is never sent and a denied tool call never runs. State where each decision is evaluated (device, browser or cloud), whether TLS interception, a forward proxy or a managed certificate is required, and whether each surface fails open or fails closed.","tier":"AT0–AT4","whyItMatters":"Where a decision runs and how it fails decide whether data is actually stopped.","verificationMethod":"D + LT","verificationTest":"The vendor documents enforcement points and failure modes per surface, and the pilot confirms them.","formerly":"ARC-015","alsoIn":["guardrails"],"sort":56,"adoptionContext":"Enforcement points and failure behavior can differ by surface, so each listed context needs its own answer.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"A documented enforcement point and failure mode support secure-architecture and resilience decisions, and show whether data in transit is actually stopped. Neither fail-open nor fail-closed is right in every case; the buyer must choose per surface and test the behavior.\nSOC 2: CC6.7 supports restrictions on unauthorized data transfers. Tested fail-open/fail-closed behavior provides evidence for assessing disruption risks and selecting mitigation under CC9.1. The buyer must approve the trade-off and implement the response; documenting a failure mode alone does not establish a complete mitigation plan.","kind":"framework","references":{"csf":["PR.IR-03","PR.DS-02"],"soc2":["CC6.7","CC9.1"],"iso27001":["A.8.27","A.8.20"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Knowing where decisions run and what happens when they cannot be made documents the control's deployment requirements and dependencies. It is readiness evidence, not proof of correct behavior under failure.","kind":"framework","references":{"rmf":["MAP 4.2"],"iso":["A.6.2.5"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-002","frameworkRefs":{"ISO27001":["A.8.27","A.8.20"],"ISO42001":["A.6.2.5"],"NIST-CSF":["PR.IR-03","PR.DS-02"],"NIST-AI-RMF":["MAP 4.2"],"SOC2":["CC6.7","CC9.1"]}}