A bank centralizes Bedrock guardrails and logging in a shared-services account while product teams build assistants in 20 workload accounts. Security forbids internet-exposed model traffic and duplicated guardrail rules. Which multi-account generative AI integration for Bedrock meets both goals?

The correct design works because workload teams keep building assistants locally while assuming central IAM roles to invoke Bedrock, VPC interface endpoints keep inference traffic private without internet traversal, one centrally managed guardrail set is referenced everywhere to prevent drift, and logs aggregate in the shared-services account for consistent audit. One incorrect design uses internet HTTPS APIs with shared guardrails and logging, which is common for rapid adoption and encrypts traffic but fails isolation because packets still leave the VPC to public endpoints instead of PrivateLink. Another incorrect design uses PrivateLink with locally tuned guardrails, which supports team autonomy and central logging but fails governance by duplicating rule sets that diverge over time and multiply review burden. The remaining incorrect design builds and runs all orchestration centrally over PrivateLink, which simplifies control and logging for a hub model but fails the operating model by denying workload accounts local development and creating scaling bottlenecks. Exam caveat: TLS encryption does not equal private connectivity, so prioritize PrivateLink wording when the scenario forbids internet exposure. Practical check: confirm private DNS resolves Bedrock to interface endpoints, endpoint policies allow only approved roles, and logs in the central account reference a single guardrail version across invocations.