Acceptance criteria
Test disabling the extension, switching browser or private mode, personal accounts and desktop or CLI routes; document residual gaps.
Why it matters
A control that is easy to bypass gives false assurance.
How to verify
Pilot testers try disabling the extension, switching browser and using CLI routes; record residual gaps.
OWASP adoption context
Shadow tools and code-agent workflows are primary contexts for testing alternate execution and connection paths that may evade the intended controls.
Framework mappings
- NIST CSF 2.0 ID.IM-02, ID.RA-01NIST AI RMF MEASURE 1.2ISO 42001 A.6.2.4SOC 2 CC4.1, CC7.1ISO 27001 Cl. 9.1, Cl. 6.1.2, A.8.29
Circumvention tests and recorded residual gaps provide control-effectiveness and verification/acceptance-testing evidence, identify vulnerabilities and inform risk assessment and improvements. Tests must match the deployment and include results; they do not establish that every route was tested or each gap was fixed or accepted by its risk owner. ISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures; generic business metrics do not qualify.