311 places controls in front of GenAI backends. Which API gateway capability set best fits?
Select an answer to reveal the explanation.
Short Explanation
Don’t leave the GenAI barn door open. Put authN/Z, rate limits, and schema validation on the gateway so 311 backends aren’t a free-for-all.
Full Explanation
311 GenAI backends should sit behind an API gateway that enforces authentication and authorization, rate limits, and schema validation. AuthN/Z ensure only approved municipal apps, agents, or users can invoke the model for resident workflows. Rate limits protect availability and cost against floods, runaway clients, or abuse. Schema validation rejects malformed or out-of-policy prompts and payloads before they reach the model, reducing injection and integration defects. The gateway becomes a consistent enforcement point in front of otherwise diverse GenAI services.
Open anonymous access with no rate limits or schema checks exposes the backend to anyone on the network path and invites both abuse and outage. Disabling auth so any internet client can prompt freely treats a city GenAI system as a public playground. Gateway logging only, without authentication or validation, records damage without preventing it—detection without access control is incomplete architecture.
Exam caveat: logging is necessary but not sufficient; exam answers emphasize enforcement (authN/Z, limits, validation) on the gateway path to GenAI backends.
Operational check: configure the 311 gateway with identity-aware policies, per-client quotas, request schema checks, and deny-by-default routing; verify unauthenticated and malformed calls fail closed before production cutover.