{"id":"PLT-013","section":"Platform, Privacy & Assurance","requirement":"Limit monitoring scope by design","acceptance":"Monitor AI destinations and agent activity only, not general browsing. Minimize captured content and allow full capture to be switched off, ring-fence named individuals such as executives, exclude personal conversations from analytics, and document the configuration for privacy, legal and workforce review.","tier":"Tier-independent","whyItMatters":"Works councils and privacy teams judge the architecture, not the policy document.","verificationMethod":"W + D","verificationTest":"Show that non-AI browsing is not captured, a ring-fenced user is excluded, and the configuration is documented.","formerly":"GOV-016","alsoIn":[],"sort":67,"adoptionContext":"Monitoring reaches employees in every listed context, so scope limits should be enforced on each surface, not only in the browser.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Limiting collection to AI activity, minimizing content and ring-fencing sensitive individuals protects personal information within the monitoring itself. A documented configuration supports review; it does not settle whether the monitoring is lawful.\nSOC 2: P3.1, P4.1 require the Privacy category and relevant information in scope.","kind":"framework","references":{"csf":["GV.OC-03","PR.DS-10"],"soc2":["P3.1","P4.1"],"iso27001":["A.5.34"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Privacy-limited monitoring is a concrete treatment for the privacy risk the control itself creates for employees. It does not replace an impact assessment of the monitoring.","kind":"framework","references":{"rmf":["MEASURE 2.10"],"iso":["A.5.4"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-013","frameworkRefs":{"ISO27001":["A.5.34"],"ISO42001":["A.5.4"],"NIST-CSF":["GV.OC-03","PR.DS-10"],"NIST-AI-RMF":["MEASURE 2.10"],"SOC2":["P3.1","P4.1"]}}