A transit authority must ensure only authorized operations staff can invoke internal foundation-model tools that summarize live service incidents. Which enterprise integration control best addresses that requirement?

Municipal enterprises should federate workforce identity-provider roles into AWS IAM and enforce RBAC on who may invoke internal operations foundation-model endpoints that summarize live service incidents. Transit ops tools that touch real-time incident narrative need the same badge-and-role discipline as the control room: only authorized operations staff assume roles that permit FM invoke, while other employees cannot. Federation plus RBAC replaces shared secrets with attributable, revocable access aligned to job function. Publishing the Bedrock API key in a rider mobile app so any employee can paste it into Postman fails confidentiality and attribution—keys in apps leak, and Postman sprawl bypasses RBAC. Disabling authentication for internal tools during disruptions fails security exactly when incident data is most sensitive and chaotic. Allowing any VPC-attached workload to call the FM without identity checks fails zero-trust principles: network presence is not identity, and lateral movement inside the VPC would inherit FM access. Exam caveat: RBAC must cover both human operators and service principals that call the FM on their behalf; map IdP groups carefully so overtime contractors and vendors do not inherit permanent ops FM rights. Pair authorization with Guardrails and logging for incident summaries that may include PII or security-sensitive details. Operational check: Federate the transit IdP; map ops roles to IAM policies limited to required Bedrock actions and resources; deny by default for other groups; review CloudTrail and invoke logs for unexpected principals during incidents; and rotate any legacy shared keys out of mobile or chat channels.