An internal analytics assistant turns staff questions into SQL and runs the generated statement against a reporting database using one shared service account that holds write permission on every schema. A quarterly review recorded two incidents where a question containing text copied from a customer ticket produced a statement that deleted rows, and one where a member of the finance team read a payroll table their own role does not permit. The team must remove both classes of incident while keeping natural-language querying. Select TWO changes that meet the requirement.
- AExecute every generated statement through a database role that holds read-only rights, so a statement that attempts to modify data is refused by the database rather than by the model. Correct
- BOpen the database connection under credentials derived from the requesting member of staff, so the query runs with that person's own permissions instead of a shared account's. Correct
- CAdd a validation step that rejects any generated statement containing a destructive keyword such as DROP, DELETE or UPDATE before the statement is submitted to the database.
- DInstruct the model in the system prompt to produce only SELECT statements and to refuse any question that appears to have been copied from a customer ticket into the query box.
- ELog every generated statement with the requesting user identity to an audit store, so a reviewer can attribute any destructive query or unauthorised read after the fact.
Why A is correct: Correct, because the destructive incidents depend on the executing account carrying write rights, and removing that right makes the deletion impossible regardless of what statement the model produces.
Why B is correct: Correct, because reading the payroll table is a confused-deputy failure where the assistant acts with more authority than the requester, and binding execution to the caller's identity restores the intended boundary.
Why C is wrong: Tempting because keyword screening is cheap and catches the obvious cases, but a deny-list over generated SQL is defeated by comments, casing and nested constructs, and it does nothing about the unauthorised read.
Why D is wrong: Tempting because it targets both symptoms in one place, but a prompt instruction cannot bind what the database will execute, and injected ticket text is exactly the input that overrides such wording.
Why E is wrong: Tempting because attribution is genuinely valuable and auditors ask for it, but logging is a detective control that records the incident after the rows are gone rather than preventing it.