4.2.3. Access Controls and Data Security for AI

💡 First Principle: An AI system is a new door into your data. It can retrieve, summarize, and act on information faster than any person, so whatever it can reach, its users can potentially reach through it. Access controls for AI must therefore follow the same principle as for people (least privilege) and must ensure that the AI never shows a user information the user would not be allowed to see directly.

Business-level controls a strategist should require:

• Least privilege: users, applications, and agents get only the access they need for their task. An HR assistant should not retrieve executive compensation for a junior employee, and a customer-service agent should not have authority to change payment details.
• Permission-aware retrieval: RAG systems and enterprise assistants must respect the original document permissions, so answers draw only on content the requesting user is entitled to see.
• Data classification: label data by sensitivity (public, internal, confidential, restricted) and define which classes may be used with which AI tools and models.
• Data minimization: send models only the data needed for the task; redact or mask sensitive fields (for example, using sensitive information filters in Amazon Bedrock Guardrails).
• Encryption and protection of data at rest and in transit, and of model artifacts.
• Data residency: keep data and processing in required regions when regulation or contracts demand it.
• Logging and audit trails: record who used AI systems, what data was accessed, and what actions agents took.
• Vendor data terms: confirm whether a provider stores prompts, uses them to train models, or shares them. (For Amazon Bedrock, AWS states that prompts and outputs are not used to train base models or shared with model providers.)

The shared responsibility model (Phase 1) frames who does what. AWS secures the infrastructure and the managed services. The customer configures identity and access, chooses encryption and logging options, classifies and governs data, decides which data enters which AI system, and controls how outputs are used. Implementing these controls is a technical team's job (and is out of scope for this exam); requiring them, funding them, and holding owners accountable is the strategist's job.

⚠️ Exam Trap: When a scenario describes an AI assistant revealing information to users who should not see it, the root cause is usually missing least-privilege or permission-aware access controls, not the model itself. Under shared responsibility, configuring access and governing data are the customer's responsibilities, even on fully managed AWS AI services.

Reflection Question: An enterprise assistant connected to all company file shares answers an intern's question by summarizing a confidential acquisition memo. Which controls failed, and which party under the shared responsibility model owned them?