AI Platform and Security

Why does the chapter say the platform must place its controls outside the model rather than rely on a filter?

1. Because filters add latency that makes conversational assistants unusable for staff
2. Because instructions and data share one channel, and no filter can list every wording that might steer the model
3. Because the AI Act forbids providers from filtering the inputs of a high-risk AI system
4. Because foundation model vendors do not allow licensees to add filters of their own

According to the chapter, where do AI Governance and AI Platform and Security meet?

1. At the model, which both books select
2. At the budget, which both books approve
3. At the supplier contract, which both books draft
4. At the evidence the platform produces

In the onboarding declaration of Nordvik Region's staff assistant, what does the setting that allows no agent tools achieve?

1. A proposal to let the assistant file letters becomes a reviewed change to the declaration
2. The assistant is reclassified as a high-risk AI system under Annex III point 5, with the duties of Article 26
3. The assistant may be used only by the small platform team that also runs the Region's coding agent
4. The gateway logs of the assistant no longer need to be retained for the 120 months the file declares

What is the platform control point for Mode 2 Embedded workplace assistants?

1. The AI gateway and the whole reference architecture, with service and end-user identity on every call
2. A managed permission policy and a fail-closed sandbox with an egress allow-list and catalogue-only skills
3. The tenant configuration: permissions, sensitivity labels, grounding scopes and audit settings
4. The agent manifest, a dedicated agent identity and a tested stop path

On what does it depend whether a system is a high-risk AI system, according to the chapter?

1. On its use under Article 6 and Annex III of the AI Act, never on its usage mode
2. On its usage mode, with Modes 4 and 5 always counted as high-risk
3. On whether the runtime is operated by the vendor or by the organisation
4. On whether the model is reached through the consumer tier or the commercial tier

When Hansa Mutual's claims-triage entry UC-2026-014 moved from Mode 4 to Mode 5, what did provisioning do?

1. It issued the new route at once and opened a review to be completed within a quarter
2. It moved the agent to the self-hosted models in the Frankfurt data centre
3. It reclassified the agent as a high-risk AI system and notified the supervisor
4. It withheld the gateway route until the agent had its own identity, manifest, stop-path test and market-bound token

When a requirement cannot be written as all four links of the chain, which link does the chapter say is usually missing?

1. The legal source
2. The platform capability
3. The evidence produced
4. The codified artefact

Article 26 of the AI Act requires deployers of high-risk AI systems to keep the logs under their control. What architectural consequence does the chapter draw?

1. The deployer must retrain the procured model on its own premises every quarter, so that the training logs count as its own records
2. The contract should require the logs to land on the deployer's platform, since logs kept only by the supplier cannot be retained
3. The deployer must build its own gateway before it may procure any high-risk AI system
4. The provider must hand over the model weights so that the deployer can regenerate the logs whenever an authority asks

Why did Hansa Mutual add the Article 12 logging profile and the Article 14 oversight binding to its claims-triage agent?

1. As group policy: an agent with write access to production needs action-level logs and a stop control whatever its legal tier
2. Because its classification record places the agent in the high-risk tier under Annex III point 5(c), like the underwriting-support model
3. Because DORA Article 28 requires both controls for every ICT third-party service provider in the register of information
4. Because the Swiss and UK supervisors demand AI Act controls for agents in their markets

Which structural decision does the chapter call the single most important one in the reference architecture?

1. Placing the feature store inside the data foundation instead of the model and feature layer
2. Running one control plane per legal entity in a group
3. Keeping the prompt repository apart from the policy repository
4. Separating the serving and inference layer from the orchestration layer above it

What rule keeps the structure of shared reference model, group baseline and market overlays sound?

1. Each market keeps a full copy of the platform manifest that it may edit freely
2. An overlay may add or tighten controls but never relax the group baseline
3. An overlay may remove the evaluation service where no local law requires it
4. The group baseline is rewritten whenever a market overlay conflicts with it

In the reduced variant for an authority that mostly procures, what happens to experiment tracking, training pipelines and feature stores?

1. The authority builds them first, because the gateway depends on them
2. They are replaced by the public algorithm register of the authority
3. They belong to the provider, and the contract carries what they would have produced
4. They are moved into the control plane together with the archive

In AIDR-0011, why did Nordvik Region reject showing caseworkers a numeric score for each claim?

1. Because a numeric score invites over-reliance
2. Because the provider's model cannot output a score
3. Because scores are special-category data under the GDPR
4. Because a score would make the system fall outside Annex III

How is an accepted AI Decision Record changed when the decision no longer holds?

1. Its body is edited in place and the date of the edit is added to the front matter
2. It is deleted from the repository once the retired model has left serving
3. It is rewritten by the generator that produces the decision log index
4. Only its status fields change, in the pull request that accepts a successor stating why it was retired

What role analysis does the chapter say is recorded in the system card of a compound system built on a third-party language model?

1. The organisation is the provider of both the model and the compound system, because it wrote the prompts and the retrieval configuration
2. The model vendor is the provider of the compound system and the organisation its distributor
3. The organisation deploys the general-purpose AI model but is the provider of the compound system it has assembled
4. The organisation is a deployer of both, since it did not train the model

Which two kinds of field does a data contract add for AI consumers, according to the chapter?

1. The name of the model team and the size of the training cluster
2. The distribution of numeric columns and the permitted purposes
3. The price per row and the licence of the pipeline framework
4. The embedding model version and the chunking strategy

Why can a public authority not rely on legitimate interest for training a model in the performance of its tasks?

1. Because the Data Governance Act reserves legitimate interest for data intermediation services under its Chapter III
2. Because EDPB Opinion 28/2024 rejects legitimate interest as a lawful basis for developing or deploying any model
3. Because Article 9 of the GDPR prohibits public bodies from processing personal data
4. Because the final sentence of Article 6(1) of the GDPR excludes it, leaving public task under Article 6(1)(e)

How does the vector store handle access control in the chapter's design?

1. The index carries its sources' access attributes, and the retriever filters on entitlements before similarity search
2. The generator is instructed in the system prompt not to quote passages the caller may not read, and a canary string detects leaks
3. Restricted documents are embedded with a separate model that only administrators may call
4. The grounding check removes restricted passages after the answer has been generated

How is the overall ML Test Score calculated from the four areas?

1. It is the sum of the four area scores
2. It is the average of the four area scores
3. It is the minimum across the four areas
4. It is the score of the monitoring area alone

Why does the chapter call rollback a registry operation, and what does it require?

1. Moving the champion alias back is immediate, provided the previous version's environment, features and dependencies still exist
2. The registry retrains the previous version from its manifest whenever the alias is moved back
3. The registry deletes the failed version, after which serving falls back to arrival order
4. The registry asks the provider to redeploy the previous version within the change envelope

In Nordvik Region's change envelope, which of these is listed as outside the envelope?

1. Retraining after 90 days on a newer release of the same data product
2. A maximum tree depth of eight within the declared range
3. A parity difference of 0.02 after retraining
4. New or removed features, or a change of algorithm family

How does the chapter define a release of an AI system?

1. The model version that most recently passed the evaluation gate, together with its model card and training manifest
2. The exact set of artefact versions that passed evaluation together, pinned by digest and signed
3. The commit on the default branch that the production alias points to
4. The deployment record written by the platform team after admission

What does the chapter conclude from the reported figures on the security of generated code and on secrets leaked in agent co-authored commits?

1. Coding assistants should be banned from every repository that holds prompts, policies or evaluation sets
2. Agent-authored changes should merge without review once the test suite passes
3. Generated changes pass the same gates as human ones and still need a second human approval
4. Only the platform team may use coding assistants, with release credentials

In the practical guide for the repository and revision model, what is the bypass list of the ruleset limited to?

1. A break-glass group of two named people whose use of it raises an alert and an incident record
2. All repository administrators, reviewed once a year by the security architect
3. The release pipeline and the coding agents that open pull requests
4. The model team during training runs, for the life of the training branch

Which three failures does the chapter say recur across the incidents of 2024 to 2026?

1. Weak passwords, missing backups and unpatched laptops
2. Model drift, biased training data and missing model cards
3. Unclear ownership, late testing and insufficient budget
4. The mutable reference, the shared CI cache and the credential believed revoked but still valid

What does the May 2026 wave against the TanStack packages show, according to the chapter?

1. That signed commits and hashed lockfiles make package registries safe to use without a mirror or a soak period
2. That provenance confirms which pipeline built an artefact, not whether it behaved as intended
3. That provenance attestations are of no value and should be dropped from the loop
4. That a soak period is unnecessary once packages carry build provenance

Where should the risks of the delivery loop be recorded, according to the chapter?

1. In a separate AI risk register owned by the model team and reviewed once a month by the small catalogue board
2. In the model card of each affected model version, under its limitations block
3. In the organisation's information security risk register, treated through its selected Annex A controls
4. In the supplier contracts, since most risks of the loop sit with suppliers and their release cycles

Why does the citizen-service prompt template prescribe an exact abstention text instead of letting the model apologise in its own words?

1. Because a fixed string can be detected and counted in evaluation; a free-form apology cannot
2. Because Article 50(1) of the AI Act prescribes the wording a system must use whenever it declines to answer
3. Because a fixed string costs fewer tokens than a generated apology
4. Because the grounding checker cannot score sentences without citations

What does the chapter say fine-tuning does more reliably than adding facts?

1. It removes the need for an evaluation set
2. It makes the model's citations traceable to a clause
3. It changes behaviour, such as tone, format and vocabulary
4. It moves the organisation from provider to deployer of the model

Which remedy does the chapter give for the failure in which the system leaks a passage the caller is not entitled to read?

1. A re-ranking stage after retrieval
2. Hybrid lexical and semantic retrieval with query rewriting
3. A larger context window for the generator
4. The entitlement filter before similarity search

What is the distinction that matters between a workflow and an agent, according to the chapter?

1. Whether a large or a small model is used
2. Who owns the control flow
3. Whether tools are reached through the Model Context Protocol
4. Whether the system runs in the cloud or on premises

In Hansa Mutual's approval policy, what does binding an approval to the action hash achieve?

1. The approval is valid for every tool call of the same class for thirty minutes
2. The agent can batch ten document requests into one approval
3. The approval is recorded in the registry together with the model version
4. The handler approves the request they were shown, not whichever request the agent sends next

Which statement about the AGENTS.md file in a repository matches the chapter?

1. It carries instructions, not enforcement, so it is paired with controls the agent cannot override
2. It replaces branch protection and code-owner approval once the coding agents in the repository have read it
3. It grants the agent a repository-scoped token and network access
4. It is the permission manifest that the policy decision point evaluates

Which of the following is one of the three principles for integrating AI with legacy systems of record?

1. Give the AI service the legacy system's full command set, since the mainframe treats every caller as a trusted employee
2. Copy the legacy data into the vector index once and retire the legacy interface
3. AI never writes directly to a system of record; a deterministic component or a person commits its proposal
4. Block every transaction of record until the inference call has returned

In the delegated token of Nordvik Region's staff assistant, what do the sub claim and the act claim identify?

1. The service identity of the assistant and the officer on whose behalf it acts
2. The officer who signed in and the department that owns the records system
3. The model version that answered and the prompt version it used
4. The identity provider that issued the token and the records-management adapter it is meant for

When is a model change behind an unchanged API contract a major version, according to the chapter?

1. Whenever the provider of the model announces a new model family
2. When the evaluation suite does not pass, as decided by the consumer's contract tests
3. When the response schema gains an optional field
4. Whenever the gateway route moves to another region

How does the chapter define digital sovereignty?

1. As running every AI workload, including training and fine-tuning, on accelerators in the organisation's own data centre
2. As buying only from providers headquartered and operated in the European Union
3. As a set of verifiable properties, such as knowing which law governs a workload and being able to change provider
4. As holding a Gaia-X label for every cloud service in use

What did applying the decision matrix do for Nordvik Region's correspondence summaries, which may include Article 9 health data?

1. It stopped the workload from going to the most convenient placement while the compliant one was not ready
2. It placed the workload with a hyperscaler EU region under a transfer assessment
3. It showed that the workload needed no placement decision at all
4. It moved the workload to an EuroHPC AI Factory for production inference

In Nordvik Region's tender profile, why is a machine-readable self-description such as a Gaia-X label weighted and not mandatory?

1. Because Gaia-X labels are only available to hyperscalers that operate sovereign regions through a European legal entity
2. Because the data protection officer had rejected the label as unreliable
3. Because weighted requirements are verified after award and mandatory ones before
4. Because only what the legal analysis makes non-negotiable is mandatory, keeping the tender open to competition

How does the chapter summarise the difference in cost risk between a cloud AI service and self-hosting?

1. Cloud cost risk is hardware price; self-hosted cost risk is the price of tokens
2. Cloud cost risk is volume, managed at the gateway; self-hosted cost risk is utilisation and staffing
3. Cloud cost risk is staffing; self-hosted cost risk is data egress fees
4. Both carry the same risk, since the unit cost of a token is fixed in each case

Which responsibilities does the customer hold in every consumption model, according to the chapter?

1. Hosting the base model, patching the serving stack and filtering unsafe content
2. Choosing the model version, the date of its retirement and whether deployments are upgraded automatically
3. Capacity, power and cooling, and the patching of inference servers
4. Data classification and lawful basis; identity, access and keys; human oversight and acceptable use

In the placement policy, what happens first when a workload's data class is special-category, classified or base-registry?

1. Rule P1 places it self-hosted; if no open-weight model passes evaluation, the answer is redesign or decline
2. Rule P4 applies: the workload goes to a cloud service with gateway routing once the cloud controls have passed
3. The workload is scored in a weighted matrix and the highest total wins
4. The workload is sent to the cloud burst tier until owned capacity is free

Why must the model tier for an agent session be decided before the session starts?

1. Because switching models during a session resends the whole history and so doubles the token cost of every later step
2. Because self-hosted models cannot continue a history begun by a cloud model
3. Because once a cloud session has read a protected file the disclosure has happened; switching model does not recall it
4. Because the AI Act requires a deployer to register the model before each session

What does the chapter say about a client setting that selects the permitted model provider?

1. It is sufficient once the managed configuration file sits in the administrator-only directory of the workspace image
2. It is a convenience, not a control, because a user can install another client or supply a cloud key
3. It should be replaced by a written instruction to engineers in the acceptable-use policy
4. It is the place where refused requests are logged as evidence

What is the practical guide's default treatment of a repository that carries no classification label?

1. It counts as public until the information owner says otherwise
2. It counts as internal and may be opened in a standard workspace
3. It counts as protected and may be read only without any agent
4. It counts as confidential, and agent access to unlabelled repositories is refused

Why is indirect prompt injection described as more dangerous for enterprises than direct injection?

1. Because it requires the attacker to hold valid credentials and a delegated token for the application's gateway route
2. Because it only affects models that were fine-tuned on raw personal data
3. Because it can be carried out only against self-hosted models
4. Because the attacker never touches the application: planted content acts when it enters the context

What does the chapter say is the property that matters in a codified threat model and guardrail policy?

1. Completeness: every OWASP entry and every conceivable attack wording is enumerated in the model before the first release
2. Linkage: the threat names the control, the control names the configuration, the pipeline proves deployment
3. Confidentiality: the threat model is kept outside the repository
4. Brevity: no more than ten threats are recorded for each system

In the casework assistant's prompt section on untrusted content, what does the rule that the prompt contains no credentials record?

1. That no control depends on the prompt's confidentiality; the case management API decides authorisation
2. That the prompt may be published unredacted in the public algorithm register alongside the threat model
3. That the model is not permitted to call any tool at all
4. That the gateway does not need to log the prompt version

Why must the entitlement filter be applied before the similarity search and never after?

1. Because filtering afterwards doubles the cost of the embedding model
2. Because the gateway cannot read entitlements once chunks are ranked
3. Because a post-filter leaks through ranking
4. Because the AI Act prescribes the order of retrieval steps

In the agent authorisation policy, which two properties does the chapter say matter more than the details?

1. An approval is bound to the hash of the specific action, and the token's subject must equal the user
2. The policy is written in Rego, and it is evaluated by Open Policy Agent
3. Refunds are capped at a fixed amount, and approvals never expire
4. The agent holds a long-lived key, and the operator can edit the log

How does the chapter position red teaming in the delivery of an AI system?

1. As a single exercise before launch that need not be repeated
2. As external discovery whose every finding becomes an automated test that also runs on a schedule
3. As a replacement for threat-led penetration testing under DORA
4. As a task for the model provider alone under Article 55, with the documentation requested in procurement

Why does the chapter say that the defender begins the race after a published fix with a handicap?

1. Because the attacker needs one exploit and the defender needs every instance patched
2. Because vendors publish patches to attackers before they reach customers
3. Because defenders may not use AI to triage advisories under the AI Act
4. Because patches for AI components cannot be tested before deployment

What lesson does the chapter draw for architects from the Arup case?

1. That video conferencing must be removed from finance departments and replaced by signed e-mail for every payment request
2. That the firm's internal systems had been compromised months earlier
3. That deepfake detection software would have stopped the transfers
4. That the approval process was the vulnerability: it treated a familiar face and voice as proof of identity and authority

In the patch-velocity policy, what does the service level for tier 1 require?

1. A patch deployed to every instance within 30 days of the advisory, verified by closing the change ticket for each system
2. A risk acceptance signed by the CISO within seven days
3. A patch or compensating control in place within 48 hours, through a pre-approved emergency change path
4. A vendor confirmation that no exploit exists before any change is made

Why does the chapter conclude that system prompts are worth writing but are not a boundary?

1. Because system prompts are visible to users and can be copied
2. Because they lower the rate of out-of-scope behaviour but leave it above zero
3. Because the AI Act forbids safety instructions in system prompts
4. Because agents do not receive the system prompt when they call tools

How does the chapter read, architecturally, the AI Act's requirement that a high-risk system can be brought to a halt in a safe state?

1. As a requirement that the agent is instructed to stop itself on request
2. As a requirement that every tool call is approved by two people
3. As a requirement that the stop path lives outside the system it stops
4. As a requirement that agents are switched off outside office hours

What is the first step of the chapter's guide for responding when an agent has exceeded its mandate?

1. Ask the agent for a summary of what it did and why, and compare that summary with the declared task before acting
2. Rewrite the system prompt with a clearer scope statement
3. Notify the model provider and wait for its analysis
4. Stop the agent and related tasks through the platform kill switch; never ask the agent to stop itself

Which rule about thresholds does the chapter set for changes to the evaluation suite?

1. A threshold may be lowered whenever the challenger narrowly misses it
2. A threshold is never lowered in the same pull request that changes the model
3. Thresholds are set by the model provider and copied into the suite
4. Thresholds apply only to high-risk AI systems and are optional elsewhere

Which of these is one of the chapter's rules for using a judge model?

1. Use the same model as the system under evaluation, so the styles match
2. Prefer absolute scores over comparison between two versions
3. Let the judge replace human evaluation once its agreement with human raters exceeds eighty per cent
4. Calibrate the judge against a human-labelled sample and record the agreement rate as evidence

In Nordvik Region's evaluation report the automated gate passed. Why did the release not proceed on that alone?

1. Because the champion had scored higher than the challenger on routing accuracy and on explanation grounding
2. Because the judge model had not been calibrated against human raters
3. Because the gate is necessary but not sufficient: human evaluation and business approval were still open
4. Because the injection resistance check had failed its minimum pass rate

Why is the evidence pipeline in the collector configuration not sampled?

1. Because Article 12 of the AI Act requires automatic recording of events, and a sample is not a record
2. Because sampling would expose prompt and completion content that hashing in the collector cannot protect
3. Because the observability back end cannot store traces that have been sampled
4. Because unsampled traces are cheaper to query than sampled ones

What does the chapter prescribe to counter a feedback loop in which case officers accept a decision support tool's suggestions by default?

1. Retrain the model more often on the recorded decisions, so that it follows the officers' latest practice
2. Hide the confidence score from the case officers
3. Record whether the human decided with or without the suggestion, and keep a small blind sample
4. Raise the alert threshold for prediction drift on the predicted route

In Nordvik Region's drift runbook, how may a drift threshold be changed?

1. By the on-call engineer silencing the alert for the affected slice
2. By the supplier, as part of the next quarterly retraining
3. By the incident manager during containment, with a note in the ticket
4. Through a pull request to the drift job, never a silenced alert

What did the weekly showback report at Nordvik Region reveal about the eligibility-explanation route?

1. It had the most requests and the lowest cost per resolved enquiry of all routes in the routing policy
2. It was served entirely from the exact-match cache at no cost
3. It exceeded the hard cap of the monthly budget in every week
4. With the fewest requests it carried 40 per cent of spend for 13 per cent of resolved enquiries

What does the chapter call the most common mistake in GPU capacity planning?

1. Buying on-demand capacity for the interactive peak
2. Sizing for the interactive peak and leaving capacity idle at night
3. Scheduling batch work into the troughs of interactive load
4. Measuring quality after adopting quantisation

How can a Software Carbon Intensity score be improved, according to the chapter?

1. Only by less energy per unit, cleaner energy or less allocated hardware; offsets do not lower it
2. By purchasing offsets equal to the operational emissions of the period and recording them in the calculation
3. By excluding the hosted model routes from the boundary of the calculation
4. By changing the functional unit from resolved enquiries to requests

What is the deeper cause of stalled pilots, according to the chapter?

1. The models used in pilots are too small for production workloads and must be replaced before the readiness review
2. Steering committees approve too few pilots each year
3. Most pilots are built beside the enterprise estate, so controls must be retrofitted at higher cost
4. Business units lack the talent to write evaluation sets

What happens at the readiness gate when an item's evidence is missing or older than the last model or prompt change?

1. The pipeline blocks deployment unless an exception is recorded with an owner and an expiry
2. The review board discusses the item and records the outcome in minutes
3. The item is waived automatically for systems that are not high-risk
4. The deployment proceeds and the gap is listed in the next quarterly report

Which option did Hansa Mutual choose in the go-live decision AIDR-0034 for the claims triage assistant?

1. A full go for all claim types and all handlers on the planned date
2. A conditional go: property claims only, 30 per cent of handlers, for six weeks
3. No go until both exceptions had been closed
4. A go for the German market only, with the other markets after a year

Why did replacing Nordvik Region's ranking model with a version without postcode features need a new decision record and an updated FRIA?

1. Because the supplier had changed and a new tender was required
2. Because the system moved from on premises to a European cloud provider
3. Because removing features lies outside the change envelope, so it could not pass as planned retraining
4. Because the new version scored lower on precision at 100 than the evaluation criterion of the decision record allows

Which of the four causes of difference between the two organisations does the chapter call the most consequential?

1. Nordvik avoids Modes 3 and 5 outside its platform team, while Hansa uses both daily and needs layered containment
2. Nordvik has two accelerators on order, whereas Hansa already reserves eight in Frankfurt and four in an EU cloud region
3. Nordvik reports to an elected body, whereas Hansa reports to an executive board
4. Nordvik uses open-weight models, whereas Hansa uses only vendor models

What makes Hansa Mutual's market overlays bite, according to the chapter?

1. Each market keeps its own copy of the platform manifest and deploys it separately through its own release pipeline and gateway
2. The group baseline is relaxed for entities outside the AI Act and DORA
3. Legal changes are collected yearly and applied to all overlays at once
4. The policy engine selects overlays from a system's declared markets and checks every processing location against them

Why does the chapter say the inventory and every approval should name the usage mode and not the brand?

1. Because brand names change too often to be kept in a register
2. Because one vendor appears in several modes, and the mode determines what the platform must provide
3. Because the AI Act forbids naming vendors in public registers
4. Because the mode is easier to detect from proxy logs than the vendor

How does the chapter reconcile the demand to protect within 48 hours with change management requirements that every change be reviewed?

1. By exempting security patches for known-exploited vulnerabilities from DORA's change management requirements altogether
2. By patching only at the monthly change window with extra reviewers
3. By leaving the decision to each system owner at the time of the advisory
4. By approving the emergency path, its canary rings and rollback in advance, making each patch a standard change

What is the test of Stage 1 of the capability roadmap?

1. No model calls outside the gateway, no standing credentials in AI workloads, and each Mode 5 agent stopped in an exercise
2. A forced model migration rehearsed end to end and no unregistered skill or connector found in a quarterly scan of the estate
3. An auditor reconstructing any release and any agent permission from records alone
4. Every use case on the golden path and a first-attempt pass at every readiness review