SPM-004 · formerly DIS-004

Detect direct model-provider API calls from employee devices

Acceptance criteria

Attribute provider, process, device, user and destination for direct API use with no browser involved.

Scripts and tools that call model APIs directly bypass every browser control and often carry the most sensitive information.

A direct API call from a pilot device is attributed to provider, process, user and destination.

Direct API use can bypass a managed browser in shadow-AI and code-agent workflows, making the device-to-provider path the relevant discovery surface.

NIST CSF 2.0 ID.AM-04, DE.CM-01, DE.CM-06 ISO 27001 A.8.16, A.5.9
Provider, process, device, user and destination attribution reveals direct API activity for monitoring and supplier-service inventory records. Connection observations need to be incorporated into maintained records and analyzed for risk. A connection record is not supplier assessment or network enforcement; unsupported encrypted and offline paths remain gaps.
SOC 2 CC7.2
Actor and destination attribution makes non-browser API use available to anomaly monitoring. A separate detection and review process must determine whether the activity is suspicious.
ISO 42001 A.4.2
Provider, process, device and destination attribution helps identify the AI resources in use. These observations are inputs to resource documentation, rather than a complete resource record or supplier assessment.