A parks commission must retain GenAI interaction logs for public-records requests while preventing sensitive tokens from being disclosed. Which advanced governance control fits?

Applying token-level redaction in retained logs used for public-records fulfillment lets the parks commission retain GenAI interaction logs while preventing sensitive tokens from being disclosed. Civic records laws often require retention and producible logs; privacy and security require that API keys, session secrets, payment fragments, and similar tokens not leave the organization. Selective masking at retention or fulfillment produces releasable records that preserve conversational accountability without exposing secrets. Retaining complete, unredacted interaction logs and disclosing every token whenever a request arrives exposes sensitive information to requesters and the public record. Refusing all public-records requests that mention chatbots is generally not a lawful compliance strategy and fails transparency obligations. Storing logs only in ephemeral chat memory with zero retention capability prevents fulfillment of legitimate records requests and weakens accountability after incidents. Exam caveat: advanced civic GenAI governance balances retention for records with redaction for privacy; the control is neither releasing everything nor keeping nothing. Practical check: define a token and secret inventory for parks GenAI logs, apply automated redaction before records export, spot-check fulfilled packages for residual secrets, keep unredacted copies only in tightly controlled legal holds if required, and train records staff on the redacted fulfillment path.