An organization is implementing a generative AI system for internal knowledge management. Employees can ask the system questions and receive answers synthesized from company documents. Which security control is MOST critical to prevent data classification boundary violations?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because without document-level retrieval access controls, a RAG-based knowledge system can synthesize answers from documents the querying user is not authorized to access — creating data classification boundary violations at scale. A is a baseline hygiene control but insufficient alone.
Full explanation below image
Full Explanation
B is correct because without document-level retrieval access controls, a RAG-based knowledge system can synthesize answers from documents the querying user is not authorized to access — creating data classification boundary violations at scale. A is a baseline hygiene control but insufficient alone. C detects violations after the fact. D is arbitrary and does not address access control.