Policy Enforcement Checklist for Rendering Boundaries

This document is a checklist designed to assist security teams in evaluating the enforcement of policies at the rendering and interaction boundary within applications. It addresses the critical question of what actions are permissible once a user session is active. The checklist includes various criteria that must be met to ensure effective policy enforcement, such as the existence of pre-render controls to prevent unauthorized content from being displayed, the granularity of policy scope, and the explicitness of decision inputs based on identity and session risk signals. Additionally, it emphasizes the importance of bidirectional policy enforcement, deterministic enforcement across endpoints, and maintaining an audit trail for policy changes. The checklist also outlines the need for clear session boundaries, controlled exception paths for emergencies, and the production of evidence for enforcement decisions. This structured approach aids in reviewing new agent workflows and validating the safety of pilot expansions.