Question

A retail bank is deploying a Copilot Studio agent that helps customers check loan eligibility. During design review, the responsible AI lead notices the agent's prompts request the customer's full date of birth, employment history, and government ID number even though eligibility scoring only requires income band and a soft credit tier already available in Dataverse. The architect must align the design with responsible AI principles before go-live. What should the architect recommend?

Accepted Answer

Redesign the agent to collect only the income band and credit tier needed for eligibility, applying data minimization so no unnecessary personal data is requested or stored.

Answer

Keep collecting all fields but encrypt them at rest and in transit so the additional personal data is protected.

Answer

Retain the full data collection and add a transparency note disclosing that the agent gathers extended personal information.

Answer

Move the agent's grounding data to a region-locked environment so the extra personal data never leaves the country of collection.