Generative AI Leader Practice Question: Business Strategies for Generative AI Solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant the assistant's service account broad project-level Owner permissions so it can retrieve any internal document it may need.

  Why it's wrong here

  Excessive permissions violate least-privilege principles and widen the blast radius if the assistant or its credentials are compromised. Retrieval should be scoped to the specific document collections relevant to regulatory inquiries. Broad Owner access also makes it harder to audit which data the assistant actually touched, undermining the governance goals of the program.

• ✗

  Disable all logging of prompts and responses to avoid storing potentially sensitive regulatory content in Cloud Logging.

  Why it's wrong here

  Removing logs eliminates the audit trail needed to investigate incidents, reproduce reported errors, and demonstrate oversight to regulators. Sensitive content can be protected through retention policies, restricted log buckets, and redaction rather than by discarding evidence. Disabling logging trades away accountability, which is exactly what a regulatory-response assistant must preserve.

• ✗

  Rely solely on the foundation model's built-in safety filters as the complete control set for regulatory accuracy.

  Why it's wrong here

  Built-in safety filters target categories such as harassment and dangerous content; they do not verify that a regulatory citation exists or that an obligation is stated correctly. Treating them as the complete control set leaves factual and legal accuracy unmanaged. They are a useful baseline layer, but the program still needs grounding evaluation, human review, and version tracking.

• ✓

  Track model and prompt versions alongside evaluation results so changes to the assistant can be compared and rolled back.

  Why this is correct

  Versioning the model, prompt template, and evaluation scores lets the team detect regressions when any component changes and restore a known-good configuration quickly. Without this traceability, a prompt tweak that reduces factual accuracy could go unnoticed in production. It is a foundational control for operating generative AI in a regulated environment where behavior must be explainable after the fact.

• ✓

  Establish a human review and approval step for every drafted regulatory response before it is sent.

  Why this is correct

  Regulatory correspondence carries legal consequences, so a qualified reviewer must validate each draft before submission. Human-in-the-loop review catches fabricated citations, misstated obligations, and tone problems that automated checks may miss. It also creates an accountability record showing that a person accepted the final text, which is a core element of responsible AI governance for high-stakes external communication.

Go deeper

Related to this question