# PLT-007: Resist common circumvention paths


- Area: Platform, Privacy & Assurance

- Verification: Live test
- OWASP adoption tier: AT0, AT3, AT4, AT6
- Formerly: ARC-011
- URL: /r/PLT-007

**Acceptance criteria:** Test disabling the extension, switching browser or private mode, personal accounts and desktop or CLI routes; document residual gaps.

**Why it matters:** A control that is easy to bypass gives false assurance.

**How to verify:** Pilot testers try disabling the extension, switching browser and using CLI routes; record residual gaps.

**OWASP adoption context:** Shadow tools and code-agent workflows are primary contexts for testing alternate execution and connection paths that may evade the intended controls.

**Mappings:**
- NIST CSF 2.0: ID.IM-02, ID.RA-01; NIST AI RMF: MEASURE 1.2; ISO 42001: A.6.2.4; SOC 2: CC4.1, CC7.1; ISO 27001: Cl. 9.1, Cl. 6.1.2, A.8.29 — Circumvention tests and recorded residual gaps provide control-effectiveness and verification/acceptance-testing evidence, identify vulnerabilities and inform risk assessment and improvements. Tests must match the deployment and include results; they do not establish that every route was tested or each gap was fixed or accepted by its risk owner.
ISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures; generic business metrics do not qualify.