nerdexam
Salesforce

AI-201 · Question #295

A company wants to retrieve patient history details to augment the AI agent response and plans to use the Data Cloud search index feature. What is best practice when considering retrieval- augmented…

The correct answer is A. Mask sensitive fields and index only non-PII data. The best practice for RAG with PII is to prevent sensitive data from entering the search index entirely by masking or excluding it, rather than relying on runtime controls or post-indexing encryption.

AI Features for Service (e.g., Einstein Bots, Next Best Action)

Question

A company wants to retrieve patient history details to augment the AI agent response and plans to use the Data Cloud search index feature. What is best practice when considering retrieval- augmented generation (RAG) for information that may contain personally identifiable information (PII)?

Options

  • AMask sensitive fields and index only non-PII data
  • BDepend on the agent's prompt to avoid exposing PII
  • CEncrypt embeddings, but still index PII records

How the community answered

(20 responses)
  • A
    70% (14)
  • B
    10% (2)
  • C
    20% (4)

Why each option

The best practice for RAG with PII is to prevent sensitive data from entering the search index entirely by masking or excluding it, rather than relying on runtime controls or post-indexing encryption.

AMask sensitive fields and index only non-PII dataCorrect

Masking sensitive fields and indexing only non-PII data ensures that personally identifiable information never enters the Data Cloud search index in the first place, which is the most effective and compliant approach. This aligns with data minimization principles and eliminates the risk that PII will be retrieved and surfaced in AI-generated responses, regardless of how the agent prompt is written.

BDepend on the agent's prompt to avoid exposing PII

Relying on the agent prompt to avoid exposing PII is not a reliable data governance control because prompt instructions can be bypassed or ignored, and PII already in the index can still be returned in retrieval results.

CEncrypt embeddings, but still index PII records

Encrypting embeddings does not remove PII from the index - the underlying records are still indexed and retrievable, meaning the AI agent can still surface PII content in its responses.

Concept tested: PII data governance best practices for RAG with Data Cloud

Source: https://help.salesforce.com/s/articleView?id=sf.data_cloud_vector_search_index.htm&type=5

Topics

#Retrieval-Augmented Generation (RAG)#Personally Identifiable Information (PII)#Data Security#AI Agents

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AI-201 Practice