A city clerk’s office must keep packet uploads out of Amazon Bedrock until schema and PII checks pass. Which pipeline design best enforces that gate?
Select an answer to reveal the explanation.
Short Explanation
Think of the FM as a locked meeting room — bad packets never get a badge. Validate schema and scrub PII first, then call Bedrock only on the clean set. That keeps junk and private fields out of the model path.
Full Explanation
For a city clerk packet pipeline, the durable control is a pre-inference gate: schema validation and PII screening must complete successfully before any staff upload is eligible for Amazon Bedrock invocation. That ordering keeps malformed packets and sensitive fields out of the foundation-model path, reduces leakage risk, and produces auditable reject metrics the clerk’s office can defend to records and privacy officers. The correct design therefore validates first and calls the FM only on packets that pass both checks.
Streaming every uploaded PDF straight to the FM and redacting only in the model response fails conceptually because sensitive content has already entered the model context; response-side redaction is not a substitute for keeping PII out of inference. Relying on Bedrock Guardrails alone while skipping pre-inference document validation also fails: Guardrails help shape allowed model behavior, but they do not replace schema enforcement or structured PII detection on the intake corpus. Fine-tuning a municipal FM on rejected packets so it “learns to ignore” malformed uploads is the wrong control plane—fine-tuning does not implement an intake gate, burns cost and time, and still risks exposing bad or sensitive content during training or inference.
Exam caveat: AIP-C01 emphasizes responsible GenAI data paths—controls belong before grounding and generation, not only after. Guardrails and model choice complement, but do not replace, validation gates for municipal document intake.
Operational check: instrument pass/fail counts for schema and PII stages, quarantine rejects with reasons, block Bedrock invoke on fail, sample weekly false negatives on PII detectors, and verify that production traces never show FM calls for rejected packet IDs.