Map identities to actions
List the human and workload identities that read data, train models, write artifacts, approve releases, and serve predictions. Grant only the permissions required for each task at an appropriate resource scope. A training identity might read an approved dataset and write model artifacts without permission to change a production endpoint. A deployment identity can be separated from the identity that prepares data. Review impersonation and service-account attachment permissions as well as direct resource roles.
Draw a table for a data scientist, training job, release pipeline, and prediction service. For each, list one required action and one privilege it should not automatically receive. Include who may impersonate each workload identity.
Protect data in notebooks and artifacts
Notebook access can grant the ability to run code under the configured execution identity. Inspect the selected access mode and permissions rather than assuming every notebook runs with the same credentials. Avoid storing credentials in cells or source control; use managed identities and approved secret mechanisms. Restrict notebook output, logs, model artifacts, and temporary datasets because they can contain sensitive data. Minimize data, set retention, and review network and encryption requirements.
A scheduled notebook exports its results to shared storage. Identify who can execute the notebook, which identity accesses the data, who can read the output, and how long the output is retained.
Treat generated content as untrusted
Prompt injection can arrive through user input or retrieved documents. A filter can help screen inputs and outputs, but it cannot replace authorization, tool argument validation, and least privilege. Enforce access checks before retrieval, restrict tools to approved actions, and require the application to validate parameters and user authorization before sensitive operations. Design and test behavior for filter outages, including whether a high-risk action should stop rather than proceed.
A retrieved document instructs an assistant to send customer records to an external address. Identify the trust boundary, a retrieval access check, an application-side tool check, and an audit event. Explain why the document is not authorization.
Monitor and respond across the lifecycle
Log enough metadata to investigate access and unusual behavior while minimizing sensitive payloads. Monitor permissions, data movement, model changes, and service errors. Use supported security controls such as IAM and, where applicable, service perimeters, encryption options, and Model Armor screening according to the current product documentation. Plan ownership, incident escalation, credential revocation, and recovery; test controls with representative abuse cases and legitimate requests to assess both missed detections and false positives.
A prediction service begins making unusual reads from a sensitive dataset. Describe an immediate containment step, evidence to preserve, and a longer-term permission review without assuming the model itself caused the access.
A training pipeline needs to read an approved dataset and write model artifacts, but does not deploy models. Which access design is the best starting point?
Keep exploring
Use the official certification page and its linked resources to validate your coverage. For guided labs, explore the Google Skills learning path. Revisit the practical exercise and explain your decision in your own words before moving on.