Field inspector tablets must send prompts to the building-code model without exposing them on the network path. Which control is required?

Requiring TLS end to end for all tablet-to-model prompt and response traffic is the control that keeps field inspector prompts from being exposed on the network path. Encryption in transit protects confidentiality and integrity of AI client-server exchanges against interception on Wi-Fi, cellular, or intermediate networks. Building-code prompts and model responses can include site details, violation notes, and other sensitive inspection content that must not travel in cleartext between municipal tablets and the model endpoint.

Terminating TLS at the gateway for all tablet-to-model prompt and response traffic fails by concept because decryption at the gateway breaks end-to-end protection and exposes prompts in plaintext at the intermediate point, which is exactly where exposure was called out. Requiring WPA3 encryption for all tablet-to-model prompt and response traffic fails because WPA3 only protects the local wireless hop and does nothing for prompt and response traffic once it leaves the access point and traverses intermediate networks to the model. Applying message-level signing for all tablet-to-model prompt and response traffic fails because signing authenticates the sender but leaves prompt and response bodies in cleartext for the remainder of the exchange, which is the data TLS end-to-end is meant to protect.

Exam caveat: Encryption in transit for AI traffic means TLS on the full prompt and response path, not just terminating TLS at the gateway for all tablet-to-model prompt and response traffic, WPA3 encryption for all tablet-to-model prompt and response traffic, or message-level signing for all tablet-to-model prompt and response traffic. Partial-coverage schemes that leave any leg of the tablet-to-model path in cleartext fail the requirement.

Operational check: Enforce TLS for tablet clients to the building-code model across the full session, block any message-level signing path for tablet-to-model prompt and response traffic that leaves traffic in plaintext, attempt a cleartext connection (fail), confirm WPA3 encryption for all tablet-to-model prompt and response traffic is not used as a substitute for end-to-end TLS, and validate certificates on field tablets before inspection shifts.