{"id":"SPM-004","section":"AI Security Posture Management","requirement":"Detect direct model-provider API calls from employee devices","acceptance":"Attribute provider, process, device, user and destination for direct API use with no browser involved.","tier":"AT0, AT4","whyItMatters":"Scripts and tools that call model APIs directly bypass every browser control and often carry the most sensitive information.","verificationMethod":"LT","verificationTest":"A direct API call from a pilot device is attributed to provider, process, user and destination.","formerly":"DIS-004","alsoIn":[],"sort":3,"adoptionContext":"Direct API use can bypass a managed browser in shadow-AI and code-agent workflows, making the device-to-provider path the relevant discovery surface.","mappings":[{"frameworks":["csf","iso27001"],"explanation":"Provider, process, device, user and destination attribution reveals direct API activity for monitoring and supplier-service inventory records. Connection observations need to be incorporated into maintained records and analyzed for risk. A connection record is not supplier assessment or network enforcement; unsupported encrypted and offline paths remain gaps.","kind":"framework","references":{"csf":["ID.AM-04","DE.CM-01","DE.CM-06"],"iso27001":["A.8.16","A.5.9"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Actor and destination attribution makes non-browser API use available to anomaly monitoring. A separate detection and review process must determine whether the activity is suspicious.","kind":"framework","references":{"soc2":["CC7.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Provider, process, device and destination attribution helps identify the AI resources in use. These observations are inputs to resource documentation, rather than a complete resource record or supplier assessment.","kind":"framework","references":{"iso":["A.4.2"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-004","frameworkRefs":{"ISO27001":["A.8.16","A.5.9"],"ISO42001":["A.4.2"],"NIST-CSF":["ID.AM-04","DE.CM-01","DE.CM-06"],"SOC2":["CC7.2"]}}