{"id":"PLT-007","section":"Platform, Privacy & Assurance","requirement":"Resist common circumvention paths","acceptance":"Test disabling the extension, switching browser or private mode, personal accounts and desktop or CLI routes; document residual gaps.","tier":"AT0, AT3, AT4, AT6","whyItMatters":"A control that is easy to bypass gives false assurance.","verificationMethod":"LT","verificationTest":"Pilot testers try disabling the extension, switching browser and using CLI routes; record residual gaps.","formerly":"ARC-011","alsoIn":["guardrails"],"sort":61,"adoptionContext":"Shadow tools and code-agent workflows are primary contexts for testing alternate execution and connection paths that may evade the intended controls.","mappings":[{"frameworks":["csf","rmf","iso","soc2","iso27001"],"explanation":"Circumvention tests and recorded residual gaps provide control-effectiveness and verification/acceptance-testing evidence, identify vulnerabilities and inform risk assessment and improvements. Tests must match the deployment and include results; they do not establish that every route was tested or each gap was fixed or accepted by its risk owner.\nISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures; generic business metrics do not qualify.","kind":"framework","references":{"csf":["ID.IM-02","ID.RA-01"],"rmf":["MEASURE 1.2"],"iso":["A.6.2.4"],"soc2":["CC4.1","CC7.1"],"iso27001":["Cl. 9.1","Cl. 6.1.2","A.8.29"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-007","frameworkRefs":{"ISO27001":["Cl. 9.1","Cl. 6.1.2","A.8.29"],"ISO42001":["A.6.2.4"],"NIST-CSF":["ID.IM-02","ID.RA-01"],"NIST-AI-RMF":["MEASURE 1.2"],"SOC2":["CC4.1","CC7.1"]}}