After an agent disclosure incident, which compensating control set best hardens the city’s AI assistants?

After an agent disclosure incident, tightening output guardrails, encrypting sensitive logs, and reducing agent tool scopes to least privilege is the best compensating control set because it simultaneously constrains what can be said, what can be done, and how forensic traces of sensitive prompts/responses are protected. Municipal AI assistants that retain broad email, database, or ticket-write tools after a leak leave the same blast radius intact. Compensating controls should shrink agency, strengthen content controls, and protect confidentiality of AI telemetry. Validating output schemas, hashing sensitive logs for integrity, and rotating agent tool keys on schedule fails because schemas only regularize format without filtering sensitive content, hashing proves tampering but does not provide confidentiality for leaked prompts, and rotation without scope reduction leaves the same over-privileged tools usable with fresh credentials. Enabling anomaly alerting, encrypting detailed traces for audit, and scheduling quarterly scope reviews fails because alerting only detects after disclosure, encrypting traces protects them at rest but does not constrain outputs or shrink tool agency, and deferred reviews leave excessive tool agency in place when immediate scope reduction is needed. Enforcing query rate limits, encrypting console sessions with TLS, and requiring SSO for agent consoles fails because rate limiting only throttles volume without stopping a single sensitive disclosure, TLS encryption protects sessions in transit but does not constrain outputs or tools, and SSO strengthens console sign-on without shrinking what the agent itself can access or say. Exam caveat: encrypting logs does not replace minimization—avoid storing raw HR content in prompt logs when possible; encryption protects data at rest but retention still creates insider and legal-discovery exposure. Operational check: re-issue agent credentials with reduced scopes, enable guardrail deny lists for HR identifiers, encrypt and access-control AI logs under the same standard as other sensitive municipal systems, and run a tabletop that replays the disclosure with the new controls before returning the agent to production.