Enforce role-based retrieval before context assembly: What control is necessary before expansion?
Role-based authorization must operate before sensitive records enter model context; redaction alone is insufficient.
The question
An employment-screening assistant retrieves resumes, interview notes, and accommodation records. Recruiters may access only resumes and notes; a separate restricted team handles accommodation records. The assistant's outputs influence interview selection, and tests show accurate retrieval when all records are indexed together. What control is necessary before expansion?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Enforce role-based retrieval before context assembly, with logs. ✓Authorization must constrain which records enter the assistant's context for each role; logging supports accountability for a consequential employment use.
- Let recruiters retrieve all records and redact sensitive details afterward.Post-retrieval redaction exposes unauthorized records to the retrieval process and may allow sensitive details to affect generated context before cleanup.
- Exclude accommodation records from recruiter searches.Exclusion may reduce exposure, but it does not establish role-based authorization for records that the restricted team must use or govern all retrieval paths.
- Use model classification to identify unauthorized employment records.A model may classify content, but it cannot replace explicit permissions for confidential accommodation records or provide a reliable authorization boundary.
The trap
Put authorization before retrieval or context construction, not only in answer cleanup. How to remember it
Role-based authorization must operate before sensitive records enter model context; redaction alone is insufficient.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Retain behavioral fine-tuning: Which conclusion correctly distinguishes the required interventions? →
- Limit tools and require approval before payments: Which permission design is best supported? →
- Build a comparable baseline for outcomes: Before replacing the current process, what evidence is most →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.
