A model returns JSON that is passed to an order API.
Check required fields, types, allowed values, and user authorization.
Choose two required controls.
Treat model output as untrusted input: validate the schema and business values, and re-check authorization on the server.
Detailed explanation
Presentation cannot validate type, values, or authorization.
Reject malformed or out-of-range output before it reaches the downstream API.
This creates injection and unauthorized-operation risks.
Do not use model output as the sole authorization decision.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01ガイドのDomain 3.4とAWSセキュリティ設計の入力検証を確認する。
Official references
What to confirm
モデル出力を認可判断やSQLへ直接使わず、サーバー側検証を行う理由を説明できる。
Key points
- Schema validation
- Authorization
- Trust boundary
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Server-side enforcement
Security decisions must be enforced where the protected operation occurs, not only in a user interface.
Injection resistance
Unvalidated generated text can alter a downstream query or command instead of remaining data.