An application requires programmatic access to watsonx.data and the team asks how governance applies to it. What is the correct answer?
Select an answer to reveal the explanation.
Short Explanation
The API isn't a loophole. Governance follows the identity that connects, so your application sees only what its service principal is entitled to see. Give it its own service principal and scope it properly.
Full Explanation
The correct answer is the statement that policies are evaluated against the connecting identity, so the application sees exactly what its service principal is entitled to see. Access policy is evaluated per request against the authenticated identity, whichever interface the request arrives through. An application connecting with a service principal receives precisely that principal's entitlements.
The statement that governance applies only to interactive console users and API connections are exempt is incorrect because it would make the API a trivial way around every control. Interface is not part of the policy decision.
The statement that applications must be granted a bypass role in order to use the API at all is incorrect because no bypass role is required or appropriate. Applications authenticate and are authorised like any other principal.
The statement that governance applies but only at the catalog level, never to individual tables, is incorrect because policy is expressible at catalog, schema and table level, and finer-grained controls apply to API access as much as to interactive use.
For the exam, state that governance follows the identity rather than the access path.