Acceptance criteria
Report a reliable account-type split at the point of use and allow policy to vary depending on account plan.
Why it matters
Contractual protections attach to the enterprise tenant, not the domain. A personal account reaches the same URL with none of them.
How to verify
Enterprise, personal and unauthenticated use of the same tool are each identified and handled per policy.
OWASP adoption context
Personal-account and vendor-assistant contexts make account ownership and plan distinctions important; tier alone does not establish contractual safeguards.
Framework mappings
The account-plan distinction helps identify the third-party service context and supplier terms needing risk review. A plan label alone does not establish the applicable relationship or complete its assessment.
Reliable account-tier context can inform permitted data destinations, access restrictions and enterprise-cloud or supplier rules. The policy linkage must work in practice; classification alone does not enforce those rules. ISO/IEC 27001: Account identification does not manage the identity lifecycle.
The observed personal, free, guest or enterprise account context supports monitoring employee technology use. An account-plan label does not manage identities or credentials or enforce access.