# PLT-013: Limit monitoring scope by design


- Area: Platform, Privacy & Assurance

- Verification: Walkthrough + Documentation
- OWASP adoption tier: Tier-independent
- Formerly: GOV-016
- URL: /r/PLT-013

**Acceptance criteria:** Monitor AI destinations and agent activity only, not general browsing. Minimize captured content and allow full capture to be switched off, ring-fence named individuals such as executives, exclude personal conversations from analytics, and document the configuration for privacy, legal and workforce review.

**Why it matters:** Works councils and privacy teams judge the architecture, not the policy document.

**How to verify:** Show that non-AI browsing is not captured, a ring-fenced user is excluded, and the configuration is documented.

**OWASP adoption context:** Monitoring reaches employees in every listed context, so scope limits should be enforced on each surface, not only in the browser.

**Mappings:**
- NIST CSF 2.0: GV.OC-03, PR.DS-10; SOC 2: P3.1, P4.1; ISO 27001: A.5.34 — Limiting collection to AI activity, minimizing content and ring-fencing sensitive individuals protects personal information within the monitoring itself. A documented configuration supports review; it does not settle whether the monitoring is lawful.
SOC 2: P3.1, P4.1 require the Privacy category and relevant information in scope.
- NIST AI RMF: MEASURE 2.10; ISO 42001: A.5.4 — Privacy-limited monitoring is a concrete treatment for the privacy risk the control itself creates for employees. It does not replace an impact assessment of the monitoring.