Government · 13 linked questions

Sovereign Citizen-Services Assistant for a Public-Sector Agency

A low-risk-tolerance government agency stands up a Claude assistant over public and restricted citizen records — under data-sovereignty law, FedRAMP-style compliance, mandatory auditability, and accessibility duties. Follow the build from platform selection through an audit, a tightening sovereignty rule, and a discovered access-control gap.

One evolving scenario Questions build on the context Rate your confidence

How to use it · Read the brief, then work top to bottom — the situation evolves as you go. Rate your confidence before submitting; on review, the “ confident & wrong” questions are the misconceptions worth fixing first. A study tool, not the graded exam.

The scenario

A national agency's Digital Services division is deploying a Claude-powered assistant to help citizens navigate benefits, permits, and case status. The assistant answers from a corpus that mixes freely public policy documents with restricted, per-citizen case records, so residency, access control, and auditability dominate every design decision. Leadership has an explicit low-risk-tolerance, high-scrutiny posture: nothing ships without a named control and an evidence trail.

Architecture: RAG assistant: retrieval over a document + case store, Claude for synthesis, no fine-tuning; a policy-driven guardrail and escalation layer in front of the model.
Existing stack: Agency private cloud with an approved managed-AI service in-region; existing IAM/attribute store, records system with per-record ACLs, SIEM for audit logs.
Compliance: National data-sovereignty statute, FedRAMP-style authorization (ATO) required, WCAG 2.1 AA accessibility mandate, full auditability of every answer.
Regions: Must execute and store data within the national cloud region; a subset of restricted records is later constrained to in-country only.
Budget: Fixed annual appropriation; procurement must flow through the agency's approved cloud marketplace, not direct vendor contracts.
SLA: 99.5% availability during service hours; graded degradation acceptable, but any residency or access-control failure must fail closed, not open.

Keep this context in mind — later questions build on it, and the situation evolves as you go.

0 of 13 answered

P5 · Q1Platform selection under sovereignty
The team must choose how to call Claude for the assistant. Data-sovereignty law requires that citizen data be processed and stored within the national cloud region, procurement must go through the agency's approved cloud marketplace, and the agency needs a documented residency guarantee for its ATO package. Which option is MOST appropriate?
How confident are you?
The situation changes
An auditor requests the control register
Two weeks into design, the agency's independent auditor asks for the control register before granting a conditional ATO: for every compliance obligation, a named control, the accountable owner, and the evidence that proves it operates. The team has controls in people's heads but nothing mapped. The auditor is explicit that undocumented controls count as no controls.
P6 · Q2Compliance control registerSelect 2
The team drafts the control register, mapping each obligation to a named control, an owner, and evidence. Which TWO register entries are well-formed and audit-ready?
How confident are you?
P3 · Q3Record-level access control in retrieval
The assistant retrieves from a store mixing public policy docs and restricted per-citizen case records. A citizen's session must never surface another citizen's restricted record. Where should record-level access control be enforced?
How confident are you?
P1 · Q4Escalation on policy, not confidence
When should the assistant stop and hand a citizen's request to a human caseworker rather than answer?
How confident are you?
P5 · Q5Fail-closed on residency/access failure
The design says any residency or access-control failure must fail closed. During a partial outage, the retrieval service cannot reach the records system's ACL service to confirm a caller's authorization. What should the assistant do?
How confident are you?
The situation changes
A sovereignty rule tightens to in-country only
A regulatory update narrows the rule: a defined subset of highly restricted records may now be processed only within the national territory — no cross-region failover, even to another in-region availability zone that sits outside national borders. The previously acceptable multi-region resilience posture is no longer compliant for that subset, and the team must revisit resilience, routing, and their register.
P5 · Q6In-country execution constraint
For the highly restricted subset now bound to in-country only, the current design fails over to a managed-platform endpoint in a neighboring country during regional stress. How should the team respond?
How confident are you?
P3 · Q7Auditability and driftSelect 2
The auditor wants ongoing assurance that the newly tightened controls keep operating, not just a one-time snapshot. Which TWO practices best provide continuous, evidence-backed auditability?
How confident are you?
P6 · Q8Updating the register after a rule change
After the in-country tightening, what is the correct way to reflect it in the control register that already backs the conditional ATO?
How confident are you?
P1 · Q9Accessibility as a first-class requirement
The agency has a legal WCAG 2.1 AA duty. A proposed feature returns answers as richly formatted images of text to look polished in the citizen portal. What is the least-risky course?
How confident are you?
The situation changes
A restricted-records access-control gap is found
During pre-ATO penetration testing, the red team discovers that while retrieval enforces per-record ACLs on the primary case store, a secondary 'related documents' index was populated without carrying over each record's ACL. Attachments linked to restricted cases are retrievable by any authenticated citizen. The control existed on paper but did not cover this index — a drift between the register and reality.
P3 · Q10Closing the access-control gap
What is the most appropriate immediate response to the discovered gap in the related-documents index?
How confident are you?
P6 · Q11Preventing recurrence and honest disclosureSelect 2
Beyond patching the index, the agency wants to prevent this class of drift and handle the incident responsibly under its high-scrutiny posture. Which TWO actions are most appropriate?
How confident are you?
P5 · Q12No fine-tuning; grounding via retrieval
A stakeholder proposes fine-tuning Claude on the full corpus of restricted case records so the assistant 'just knows' the answers and retrieval can be simplified. Why is this the wrong move for this agency?
How confident are you?
P7 · Q13Evaluating before the ATO decision
Before the auditor's ATO decision, leadership wants evidence the assistant behaves safely on the sensitive access-control and escalation paths. What evaluation approach best fits the agency's low-risk-tolerance posture?
How confident are you?

All case studies