Question 1
A contact-center assistant must answer policy questions with citations and may also update a customer case, but only when the signed-in agent is authorized. Which architecture meets both needs without treating model text as permission to change records?
Explanation
Correct Answer
Knowledge Base retrieval supplies cited policy context; a tool/API layer independently checks identity, record-level permission, arguments and transaction outcome for each mutation.
Incorrect Answers
RetrieveAndGenerate retrieves evidence and creates text with citations; it does not grant business authorization or execute a case-record transaction.
A credential in a prompt can be disclosed and bypasses caller-specific permission checks. S3 storage alone is not an authorized tool boundary.
Well-formed model text can be incorrect or adversarial. The application must validate caller rights and action parameters before executing a write.



AWS Certified Generative AI Developer - Professional AIP-C01 Practice Tests