A housing authority shadows production traffic to a candidate model, including sensitive eviction and disability case records. What constraint should MLOps add?
Select an answer to reveal the explanation.
Short Explanation
Shadow traffic is a dress rehearsal — you do not invite sealed case files to the open stage. Exclude sensitive case classes from shadow and canary. All-cases mirroring, public narrative logs, and clock-based rules do not protect privacy.
Full Explanation
A housing authority that shadows production traffic to a candidate model, including sensitive eviction and disability case records, should exclude sensitive case classes from shadow and canary inference. Shadow and canary still process real municipal data; they are not privacy-free because the destination is “non-prod serving.” Filtering highly sensitive case categories reduces secondary processing, logging, and retention of sealed or specially protected records while still allowing shadow tests on less sensitive traffic classes where policy permits.
Shadowing every case type with no filtering for maximum realism fails because realism does not override privacy constraints on eviction and disability data. Logging full case narratives from shadow runs to a public dashboard fails because it publishes sensitive content. Requiring shadow traffic only during business hours fails because clock limits do not change which sensitive classes are processed.
Exam caveat: shadow/canary are still data processing activities; municipal exams expect class-based exclusions for sensitive housing records, not “full mirror for fidelity.”
Operational check: maintain an allow/deny taxonomy for shadow eligibility; strip or tokenize sensitive fields when policy requires; ensure shadow logs inherit the same retention and access controls as production case systems; audit canary jobs for accidental inclusion of excluded classes.