A facilities maintenance team receives AI-generated authentication code for a work-order portal prototype. What boundary should they enforce?
Select an answer to reveal the explanation.
Short Explanation
Auth code from a model is a sketch, not a vault door. Keep it in prototype land until security reviews it—compiling is not the same as being safe to ship.
Full Explanation
Facilities maintenance must treat AI-generated authentication code for a work-order portal as prototype material that requires security review before production use. Compilation success proves little about credential storage, session fixation, password reset flows, or MFA. The correct boundary is clear: generative auth scaffolds accelerate demos; production authentication is a security control subject to review, testing, and standards—not a weekend paste into live systems.
Shipping AI-generated auth code to production without security review because it compiled fails because compile/runtime success is not a security assurance argument. Publishing private keys in the prototype README to help other cities copy the design fails by leaking secrets and teaching unsafe patterns. Disabling multi-factor options permanently if the generated sample omitted them fails by concept: sample incompleteness must not redefine the city’s authentication policy; MFA requirements come from security standards, not from what a model happened to emit.
Exam caveat: prototype auth often uses insecure defaults (hard-coded users, verbose errors, HTTP cookies without flags). Security review should assume hostile defaults until proven otherwise, especially for a portal that may later touch facilities access or vendor data.
Operational check: quarantine the generated auth code as prototype-only, run a security review checklist (secrets, session, MFA, lockout, logging), ban README private keys, and replace or harden the scaffold before any production work-order traffic is allowed.