Question

A retail company is deploying a generative AI assistant that connects to several internal systems (inventory, HR records, and finance) through plugins so it can answer employee questions. During a security review, the team notices the assistant's service account has read access to all three systems for every user, regardless of the user's own permissions. What is the most important security consideration the AI Transformation Leader should prioritize to address this?

Accepted Answer

Enforce that the assistant respects each user's existing identity and access permissions so it only retrieves data the requesting user is already authorized to see

Answer

Reduce the model's context window size to limit how much data can be returned in a single response

Answer

Fine-tune the model on the internal datasets so it memorizes the data and no longer needs live system access

Answer

Shorten prompts and cap output tokens to reduce the cost of each query to the connected systems