Model admin consoles for the elections assistant must not be reachable from the public Internet. Which control best enforces that?

Blocking Internet access to elections model admin consoles and requiring internal paths is the control that keeps privileged administration off the public Internet. AI admin consoles can change models, prompts, keys, and safety settings; for an elections assistant, compromise of that plane is high impact. Network access control that denies public reachability and requires internal (or otherwise tightly controlled) admin paths protects the management plane while the voter-facing chatbot can remain separately published. Isolating elections model admin consoles in private subnets with public ingress rules fails because public ingress rules reopen Internet reachability; private placement alone does not block public access, which is exactly what must be blocked. Blocking Internet access to elections model admin consoles but allowing public API gateway fails because the public gateway preserves an Internet path to admin; the console remains reachable from the public Internet, which is exactly what must be blocked. Requiring internal paths to elections model admin consoles through public ingress endpoints fails because public ingress endpoints keep the consoles exposed to the Internet; internal routing through a public entry point does not block public reachability, which is exactly what must be blocked. Exam caveat: Separate AI admin planes from public chat surfaces and from the public Internet entirely. Private subnets with public ingress rules, blocking with a public API gateway exception, and internal paths through public ingress endpoints do not block public reachability and are all ways admin quietly remains reachable from the Internet. Operational check: Put elections model admin on internal-only networking, verify Internet clients cannot reach it, remove public ingress rules and public API gateway paths to admin, do not count private subnets with public ingress or internal paths through public endpoints as blocking, and confirm the public chatbot still functions without exposing admin routes.