Question 10
A newly acquired retailer needs customer account lookup across two identity systems; the legal team prohibits bulk copying user profiles until consent and data ownership are reviewed. Which limitation must be considered before claiming the issue is fully resolved?
Explanation
Correct Answer
Working federation does not automatically authorize copying regulated customer attributes. This caution prevents extrapolating beyond the specific evidence or product boundary. Integration architecture must satisfy explicit data ownership and consent boundaries. The unresolved point should be tested using legal data flow assessment, identity mapping and consent records for both businesses rather than assuming a working interface proves full compliance or resilience.
Incorrect Answers
Federated sign-in grants blanket consent for unrestricted personal data movement. This limitation is framed as a blanket exception, but the case requires a different, narrower caution. The relevant boundary is that working federation does not automatically authorize copying regulated customer attributes. Integration architecture must satisfy explicit data ownership and consent boundaries. Inspect legal data flow assessment, identity mapping and consent records for both businesses.
Permission to authenticate is also permission to share all account attributes. The proposed claim mistakes an incomplete signal or product feature for a universal guarantee. The relevant boundary is that working federation does not automatically authorize copying regulated customer attributes. Integration architecture must satisfy explicit data ownership and consent boundaries. Inspect legal data flow assessment, identity mapping and consent records for both businesses.
An API gateway can enforce consent without a source-data classification review. This claim exceeds the evidence and ignores an important risk or operational dependency. The relevant boundary is that working federation does not automatically authorize copying regulated customer attributes. Integration architecture must satisfy explicit data ownership and consent boundaries. Inspect legal data flow assessment, identity mapping and consent records for both businesses.