5.2Standard
An agent can search, create tickets, and send mail.
Limit generated actions.
Choose two designs.
× Incorrect
Separate read, write, and send tools and limit targets, arguments, identities, approvals, previews, audit, and cancellation for high-impact actions.
Detailed explanation
CorrectSeparate read, write, and send permissions and limit target, argument, identity, and approval
Side effects are bounded.
IncorrectSend mail directly from generated text without confirmation
Unintended effects can occur.
IncorrectGive every tool one administrator identity
Least privilege is broken.
CorrectUse preview, confirmation, dual approval, audit, and cancellation for high-impact actions
Mistakes are contained.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.2・2.3のツール利用、IAM、最小権限を確認する。
Official references
What to confirm
自然言語の生成結果をそのまま副作用へ接続せず、操作と承認を分離できる。
Key points
- Tool boundary
- Side effect
- Approval
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Tool permission boundary
A limit on which tool actions, resources, and principals an AI workflow may access.
Side effect
A change to an external system caused by an operation.
Question IDAWS-AIF-528
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue