The original team’s access scope applies broadly: Which prior assumption must be revisited?
The new user population invalidates the original access scope, and model instructions cannot replace enforceable retrieval authorization.
The question
A university research office uses retrieval over grant records. The original assistant served one authorized project team; it is now proposed for all researchers, including users who should not see confidential budget attachments. The retrieval index contains mixed-access records, and the model is not permitted to approve access changes. Which prior assumption must be revisited?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Model instructions can enforce attachment permissions.Instructions are not an authorization boundary; permissions require enforceable access controls outside model behavior.
- Retrieval improves answers for research questions.Retrieval may improve relevant grounding, but that benefit does not resolve mixed permissions or confidential attachment exposure.
- A larger index will reduce confidentiality risk.Increasing indexed content can expand exposure unless access controls restrict retrieval to authorized users and records.
- The original team’s access scope applies broadly. ✓Expanding the user population invalidates the prior access assumption; retrieval must enforce authorization for records and attachments.
The trap
Treat retrieval authorization as a system boundary; do not rely on prompts to enforce record-level permissions. How to remember it
The new user population invalidates the original access scope, and model instructions cannot replace enforceable retrieval authorization.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Fine-tuning supplies current inspection facts: Which prior assumption no longer holds? →
- Restrict tool authority and require documented approval: What control decision is required before the agent →
- Manual performance is already known: Which prior assumption must be revisited? →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.
