{"id":"SPM-008","section":"AI Security Posture Management","requirement":"Distinguish personal, free and guest accounts from sanctioned enterprise tenants","acceptance":"Report a reliable account-type split at the point of use and allow policy to vary depending on account plan.","tier":"AT0, AT1","whyItMatters":"Contractual protections attach to the enterprise tenant, not the domain. A personal account reaches the same URL with none of them.","verificationMethod":"LT","verificationTest":"Enterprise, personal and unauthenticated use of the same tool are each identified and handled per policy.","formerly":"DIS-006","alsoIn":["value"],"sort":7,"adoptionContext":"Personal-account and vendor-assistant contexts make account ownership and plan distinctions important; tier alone does not establish contractual safeguards.","mappings":[{"frameworks":["rmf"],"explanation":"The account-plan distinction helps identify the third-party service context and supplier terms needing risk review. A plan label alone does not establish the applicable relationship or complete its assessment.","kind":"framework","references":{"rmf":["MAP 4.1"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Reliable account-tier context can inform permitted data destinations, access restrictions and enterprise-cloud or supplier rules. The policy linkage must work in practice; classification alone does not enforce those rules.\nISO/IEC 27001: Account identification does not manage the identity lifecycle.","kind":"framework","references":{"soc2":["CC6.7","CC9.2"],"iso27001":["A.8.3","A.5.23"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"The observed personal, free, guest or enterprise account context supports monitoring employee technology use. An account-plan label does not manage identities or credentials or enforce access.","kind":"framework","references":{"csf":["DE.CM-03"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-008","frameworkRefs":{"ISO27001":["A.8.3","A.5.23"],"NIST-CSF":["DE.CM-03"],"NIST-AI-RMF":["MAP 4.1"],"SOC2":["CC6.7","CC9.2"]}}