How do you handle ambiguity when given an architectural scenario or security incident with incomplete information?