Security must approve expanding a 311 bot citywide. Which model-control requirement best gates that expansion?

Expanding a 311 bot citywide multiplies the impact of unsafe or policy-violating outputs, so model evaluation is a security control gate—not optional polish. Requiring evaluation scores on toxicity and policy-refusal tests before expansion verifies that the assistant declines harmful content and stays within municipal service policies under adversarial or frustrated resident prompts. Security approval should depend on those scores meeting predefined thresholds under representative 311 scenarios, not on evaluation scores on hallucination and confabulation tests, which detect invented content but fail to detect toxic or policy-violating outputs.

Requiring evaluation scores on hallucination and confabulation tests before citywide expansion provides no measurable toxicity or refusal evidence, as low hallucination rates do not guarantee the model refuses harmful content or stays within policy. Requiring evaluation scores on bias and stereotype association tests before citywide expansion addresses only stereotyped associations, not toxicity or policy refusal, leaving unsafe outputs unchecked. Requiring evaluation scores on factuality and citation grounding tests before citywide expansion verifies only that answers are factually supported, not that the model refuses toxic or policy-violating prompts, leaving unsafe outputs untested.

Exam caveat: toxicity and policy-refusal evaluations are expected gates before broad municipal rollout of citizen-facing bots. Operational check: run toxicity and policy-refusal suites on a representative 311 prompt set, record scores against thresholds, retest after prompt or model changes, and withhold citywide enablement until security signs off.