A transit GenAI architecture diagram shows “trust the model” as the authorization layer for fare-dispute decisions. What correction should security insist on?

GenAI models are probabilistic and subject to prompt manipulation, so they must not serve as the authoritative authorization mechanism for municipal actions such as fare-dispute outcomes. Architecture should use deterministic authorization controls—IAM policies, policy engines, and explicit entitlements—while the model may assist with drafting explanations or summarizing evidence. Security must insist that "trust the model" is removed as an authZ layer for transit disputes and similar privileged decisions.

Increasing temperature so authorization decisions feel more natural worsens nondeterminism and is antithetical to stable access control. Replacing all IAM policies with prompt instructions only moves enforcement into manipulable natural language that attackers can steer. Allowing the model to mint its own OAuth tokens after each dispute grants a probabilistic component the power to create credentials without an independent issuer.

Exam caveat: LLMs can recommend actions; they must not decide privileged transit mutations without an independent policy decision point that cannot be overridden by prompt text. Operational check: implement deterministic authZ for fare-dispute mutations, ensure the model cannot call privileged APIs without a separate policy check, and remove diagram language that equates model judgment with authorization.