Transit RAG redacts sensitive fields in the UI display but still embeds the unredacted source chunks. What sequencing flaw remains?
Select an answer to reveal the explanation.
Short Explanation
Blacking out the SSN on screen while the vector still holds the full chunk is theater. Scrub before you embed—otherwise retrieve just undoes the makeup.
Full Explanation
Redaction must occur before embedding so sensitive content never enters the vector index, not only at render time. Transit RAG that blacks out fields in the UI while still embedding unredacted source chunks leaves the full sensitive text available to retrieve, re-prompt, logs, and anyone with index access. UI cosmetics do not equal data minimization. Scrub or tokenize sensitive fields in the ingest pipeline, then embed only the redacted form used for rider-facing retrieval.
Claiming UI redaction automatically updates all historical embeddings overnight fails by concept: display filters do not rewrite stored vectors. Accepting unredacted embeddings because the chat UI uses HTTPS fails because transport encryption does not remove sensitive plaintext from the index. Asserting render-time redaction is sufficient because retrieval cannot access indexed text fails; retrieval’s purpose is to access indexed text for generation.
Exam caveat: Sequence matters—minimize then embed. Render-only redaction is a common false control on civic GenAI exams.
Operational check: Confirm ingest redacts SSNs and similar fields before embed, delete and rebuild indexes that held unredacted chunks, verify retrieve returns only redacted text, and test that UI and API paths cannot request “unredacted mode” on the public assistant.