A county government is deploying an agent across multiple Google Cloud regions and must ensure resident data the agent collects never leaves the jurisdiction's approved region. Where should this constraint be enforced?
Select an answer to reveal the explanation.
Short Explanation
Relying only on a bucket's region setting is like locking the warehouse door but leaving every loading dock along the delivery route wide open — the data could still wander before it ever gets there. Enforcing the boundary at the agent's access layer means every request, not just the final storage step, gets checked against the region rule. That's the difference between catching a leak at the source and hoping it never happens.
Full Explanation
Enforcing a data residency constraint at the agent's access and execution layer means every read or write the agent performs is checked against the approved region as it happens, closing off the paths data could take before it ever reaches final storage, including intermediate processing, caching, or cross-region tool calls. Configuring only the storage bucket's region addresses where data lands at rest but says nothing about the region in which the agent processed that data on the way there, so a compute step or an intermediate service in another region could still touch resident data before it's ever written. Relying on documentation instructing engineers not to route data outside the approved region is a policy statement with no technical enforcement, and it depends on every engineer, on every change, remembering and correctly implementing that instruction. Periodic manual audits can eventually discover a violation, but discovery after the fact doesn't prevent the data from having already crossed the boundary, which defeats the purpose of a residency requirement in the first place. A scope caveat: enforcing residency at the access layer still requires the underlying regional infrastructure choices, like where a given service is deployed, to be consistent with the same boundary. As an operational check, an architect can attempt a request that would process resident data through a resource outside the approved region and confirm it is rejected rather than merely logged.