A banking assistant's get_transactions tool accepts an account_id argument filled in by the model from the conversation, and calls the core-banking API with a service credential that can read any account. Customers authenticate to the app with MFA. Which gap is most serious, and what fixes it?

Answer: C — Account identity comes from model output; bind it to the session and authorize it server-side on each call

Any customer can name another customer's account in conversation (or via injected text), and the handler trusts the model-supplied ID while using a credential that can read everything: a confused deputy. Bind account identity to the authenticated session and check entitlement in code on every call (ideally with a customer-scoped token). (a) strengthens login, which already succeeded. (b) is good hygiene but doesn't stop cross-account reads. (d) treats a security gap as an extraction-accuracy problem.