Bounding agent tool permissions | AWS Certified AI Practitioner (AIF-C01) original practice question

5.2Standard

An agent can search, create tickets, and send mail.

Limit generated actions.

Choose two designs.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

Detailed explanation

CorrectSeparate read, write, and send permissions and limit target, argument, identity, and approval

Side effects are bounded.

CorrectUse preview, confirmation, dual approval, audit, and cancellation for high-impact actions

Mistakes are contained.

IncorrectSend mail directly from generated text without confirmation

Unintended effects can occur.

IncorrectGive every tool one administrator identity

Least privilege is broken.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.2・2.3のツール利用、IAM、最小権限を確認する。

自然言語の生成結果をそのまま副作用へ接続せず、操作と承認を分離できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-528

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20