ALT A table showing minimum security and governance expectations for patient-facing retrieval-augmented generation chatbots. It has columns for Domain, Key Question, and Minimum Expectation. Domains include Configuration, Access control, Data stewardship, Knowledge base, Response minimization, Monitoring, Independent audit, and Dual-use readiness. Key questions address aspects like system prompts and RAG parameters, administrative and data end points, and storage of patient conversations. Minimum Expectation provides requirements such as verifying access, assuming redactions, and having audits before launch.