A stormwater bureau finds unapproved browser extensions sending clerk-screen text to outside AI services. What control best prevents that uncontrolled leakage?
Select an answer to reveal the explanation.
Short Explanation
You’re right to stop unapproved extensions before they send clerk-screen text outside the bureau. Allow-listing approved tools helps protect municipal data while letting staff use reviewed AI services.
Full Explanation
Unapproved browser extensions that send clerk-screen text to outside AI services create classic shadow-AI leakage: municipal data can leave managed endpoints without review, logging, contractual protections, or records controls. Blocking shadow-AI browser extensions on clerk workstations and allowing only approved tools is the effective control; endpoint management and allow-listing enforce it before data leaves. Encouraging staff to install any AI extension that looks helpful invites uncontrolled disclosure and support problems. Disabling endpoint management so extensions install silently removes the enforcement plane. Requiring clerks to paste the same sensitive screens into more public bots multiplies the breach rather than containing it. Exam caveat: allow-lists need maintenance as business units request new tools, and shadow AI can also arise through copy-paste into web apps or personal phones, not only extensions. Pair technical blocks with an approved AI path so work does not move to unmanaged devices. Operational check: attempt to install a known unauthorized AI extension on a managed clerk image, confirm the block, verify approved tools still function, and sample proxy or EDR telemetry for residual calls to non-approved AI domains from stormwater workstations.