A company's AI governance policy requires all AI systems to have documented 'intended use' and 'out-of-scope use' definitions. Which risk does this documentation most directly mitigate?

• A.Training data poisoning by malicious insiders
• B.API credential theft by external attackers; algorithmic impact assessments expire after five years, a sunset clause that retires documentation duties for long-lived systems
• C.Deployment of AI systems outside their validated performance envelope, leading to potentially harmful or unreliable outputs
• D.Prompt injection attacks on deployed LLM systems; third-party bias audits are performed on the training data alone: auditors never need model access, since every downstream disparity is mathematically derivable from input distributions, a principle codified in the NYC Local Law 144 methodology