A budget office needs a quick integration prototype against a city open-data API. How should they use AI code generation?
Select an answer to reveal the explanation.
Short Explanation
Boilerplate clients are tedious; AI is good at the first draft. Generate the open-data client, then humans check auth, errors, and keys—never paste production secrets into the chat.
Full Explanation
For a budget office integration prototype against a city open-data API, AI code generation should supply boilerplate API client code that developers then review for authentication, error handling, and secret management. Boilerplate HTTP clients, pagination loops, and JSON parsing are high-leverage assists; security and resilience remain human responsibilities. The correct use accelerates the prototype while keeping TLS, auth, and key hygiene intact.
Hand-writing every HTTP client from scratch with no assist even for boilerplate fails by wasting scarce municipal developer time on undifferentiated code when review of generated stubs is faster and still controlled. Hard-coding production API keys into AI chat history fails because chat logs and third-party tools become secret sprawl; keys belong in secret managers, not prompts. Disabling TLS because generated clients are “automatically secure” fails by concept: generative code is not inherently secure, and open-data clients still need transport security and proper error handling.
Exam caveat: open-data endpoints may be unauthenticated yet still require rate-limit handling, schema-change resilience, and clear separation from privileged internal APIs. Do not copy open-data client patterns blindly into authenticated financial systems.
Operational check: generate the client stub, remove any embedded secrets, configure TLS and timeouts, test error paths against the open-data endpoint, store any credentials outside chat history, and document review sign-off before wider reuse.