A regional transit consortium is establishing data-security access controls for AI-flagged rider records. How should access to those records be structured?
Select an answer to reveal the explanation.
Short Explanation
Handing everyone a master key is convenient right up until something goes wrong. Limiting access by role means the people who actually need to see flagged rider records can, and everyone else can't just browse them out of curiosity. It's the difference between a locked file cabinet and an open one in the break room.
Full Explanation
Role-based access control ties visibility of sensitive data to demonstrated operational need, so that AI-flagged rider records are visible only to the staff positions whose job actually requires reviewing them, such as safety or incident-response roles. This limits exposure of personal and potentially sensitive information while still letting the right people act on flagged incidents. Granting access agency-wide for situational awareness sounds collaborative but massively expands the number of people who could mishandle, misuse, or accidentally leak sensitive rider data, with no corresponding operational benefit for most of those employees. Leaving access ungoverned and assuming staff will self-limit their own curiosity is not a control at all; it relies on individual discretion rather than an enforced system boundary, and audits would find no way to verify who accessed what. Restricting access to executive leadership only excludes the frontline staff who are actually positioned to respond to a flagged incident in real time, defeating the tool's operational purpose. A scope caveat: role definitions need periodic review, since staff change positions and access should follow the role, not linger with a former assignment. A concrete operational check is to run a periodic access-log review confirming that only currently assigned roles retain visibility into flagged records.