A team has finished prototyping a Foundry-hosted chatbot for internal HR questions and is preparing to move it into production for all employees. Before launch, which two actions should they take? (Select TWO.)
Select all correct answers, then click Submit.
Short Explanation
Moving from a small prototype to something every employee in the company can use means tightening two things before launch. First, actually measure how well it performs, running it through evaluation tools against a set of realistic HR questions to see whether its answers are grounded in the right source material and actually relevant, rather than just trusting that it seemed fine during testing. Second, make sure the safety filtering is turned on so the system has a guardrail against producing something harmful or inappropriate once it is live for a whole company. What you should not do is strip out logging entirely, since that just removes your own ability to investigate anything that goes wrong later, privacy concerns can be handled without deleting the evidence trail completely. And you definitely should not embed the access key directly into code that gets sent to every employee's browser, because anyone can open the page and read it straight out, which is basically handing out the key to anyone who looks.
Full Explanation
The correct answers are B and C. Running Foundry's built-in evaluation tools against representative HR questions measures whether the chatbot's answers are grounded in the intended source material and relevant to what employees actually ask, catching quality problems before a companywide rollout, and configuring content safety filtering reduces the risk that the deployment produces harmful or inappropriate output once every employee can reach it. Both are standard readiness steps before widening access to a production audience. Option D is incorrect because removing all logging does not improve quality or safety, it instead strips the team of the diagnostic trail needed to investigate reported problems after launch, and reasonable logging can coexist with privacy safeguards rather than requiring its complete elimination. Option A is incorrect because embedding an API key in client-side code served to every browser exposes that key to anyone who inspects the page, letting it be extracted and misused outside the intended application; API keys belong in a protected backend, not shipped to end-user browsers.