# SPM-008: Distinguish personal, free and guest accounts from sanctioned enterprise tenants


- Area: AI Security Posture Management

- Verification: Live test
- OWASP adoption tier: AT0, AT1
- Formerly: DIS-006
- URL: /r/SPM-008

**Acceptance criteria:** Report a reliable account-type split at the point of use and allow policy to vary depending on account plan.

**Why it matters:** Contractual protections attach to the enterprise tenant, not the domain. A personal account reaches the same URL with none of them.

**How to verify:** Enterprise, personal and unauthenticated use of the same tool are each identified and handled per policy.

**OWASP adoption context:** Personal-account and vendor-assistant contexts make account ownership and plan distinctions important; tier alone does not establish contractual safeguards.

**Mappings:**
- NIST AI RMF: MAP 4.1 — The account-plan distinction helps identify the third-party service context and supplier terms needing risk review. A plan label alone does not establish the applicable relationship or complete its assessment.
- SOC 2: CC6.7, CC9.2; ISO 27001: A.8.3, A.5.23 — Reliable account-tier context can inform permitted data destinations, access restrictions and enterprise-cloud or supplier rules. The policy linkage must work in practice; classification alone does not enforce those rules.
ISO/IEC 27001: Account identification does not manage the identity lifecycle.
- NIST CSF 2.0: DE.CM-03 — The observed personal, free, guest or enterprise account context supports monitoring employee technology use. An account-plan label does not manage identities or credentials or enforce access.