SAI-240 knowledge check

How to use this assessment

Complete the questions without referring to the chapter text. Then review the guidance and update your policy package where your answer exposes a gap.

This public knowledge check supports learning. It does not provide production DLP rules or guarantee detection of sensitive content.

Scenario questions

1. Trust after the gateway

A downstream service assumes a request is authorized simply because it arrived through the gateway. Explain why that assumption is unsafe.

2. What delegation must state

A service uses one shared identity to act on behalf of every user. Explain what a bounded delegation should specify instead.

3. Policy table contents

A gateway policy is written as a single rule: "allow trusted users." Explain what a usable policy decision table needs beyond this.

4. DLP detection limits

A team claims their content inspector "guarantees" no sensitive data ever leaves the boundary. Explain why this claim cannot be true.

5. Streaming bypass risk

A policy check is designed to inspect a complete response before it is returned. Explain how a streamed response can bypass that check.

6. Unavailable local capacity

Local model capacity is exhausted during a burst of traffic. Describe the acceptable options, and the one that should never happen silently.

7. Egress bypass paths

An egress policy pins approved destinations by identity and contract. Name the technical paths a review must test to confirm nothing bypasses that pinning.

8. Evidence without raw content

A team wants to investigate a blocked request without storing the full prompt or file contents. Explain what a useful evidence record can capture instead.

Answer guidance

1. Passing through the gateway is not proof of authority for a specific downstream action. Downstream services must independently validate issuer, audience, lifetime, and required claims at each hop, and reject authority outside their own scope even if the gateway forwarded the request.
2. A bounded delegation should state who acts for whom, the permitted resources and actions, audience, purpose, duration, and constraints — not a reusable credential or a blanket assumption that one service identity implies every user's permissions.
3. A usable table defines, for each request class: subject, purpose, data classification, input type, destination, model or tool, permitted actions, limits, required inspections, transformations, approval requirements, evidence, and failure behavior, with deterministic rule priority.
4. Pattern-based, classifier-based, and model-based detectors each have false positives, false negatives, language limits, and evasion techniques. Layering controls reduces risk, but no detector or stack of detectors can be claimed to catch everything.
5. A streamed response can be inspected chunk by chunk, letting policy-violating content be split across chunk boundaries or emitted before an evaluation of the complete response finishes — bypassing a check designed for buffered content.
6. Deny, queue, request approval, or provide a locally approved degraded result. Silently switching to a public or less-controlled endpoint because local capacity is exhausted should never happen without independent approval and evaluation of that fallback.
7. DNS manipulation, redirects, alternate protocols, direct service endpoints, administrative paths, and retry logic — any of these could route a request to a destination the identity and contract pinning did not approve.
8. Record policy version, rule and reason codes, the action taken, timing, actor and destination references, approval status, and a correlation ID — structured decision metadata supports investigation without retaining the raw prompt or file content.

Completion rubric

Mark the gateway policy package complete only when:

• Identities and delegated authority are bounded and independently validated at each hop.
• Policy decisions and their failure behavior are deterministic, not ad hoc.
• Inspection and DLP controls declare their known limits rather than claiming completeness.
• Routes and egress destinations are approved and pinned per context.
• Response controls handle leakage, size, and embedded instructions.
• Bypass paths and degraded-mode cases have been explicitly tested.
• Evidence is correlated, minimized, and versioned rather than raw and unbounded.

Completion outcome

SAI-240 is complete when the learner can explain why passing through the gateway is not the same as being authorized downstream, and can produce the policy package from the AI gateway policy workshop.