Security architects ask an AI assistant to propose STRIDE-style questions for a new elections voter-lookup portal, then decide which threats to track. What is the appropriate role of the AI tool?

For an elections voter-lookup portal, an AI assistant that proposes STRIDE-style questions accelerates threat-modeling workshops by surfacing spoofing, tampering, repudiation, information-disclosure, denial-of-service, and elevation themes humans might skip under time pressure. The appropriate role remains facilitation: architects and elections owners decide which threats enter the register, what residual risk is accepted, and which compensating controls are funded. Adding proposed STRIDE questions to tracking while humans own the risk decisions still confuses prompts with vetted threats; tracking should hold only threats humans have accepted after review, not every brainstorming question the model suggested. Assigning severity ratings for release decisions while humans own the risk decisions is self-contradictory because rating severity is itself a risk decision; humans cannot retain ownership if the model sets the rating that drives portal release approval. Generating control validation evidence for review while humans own the risk decisions still fabricates assurance without real testing; draft text for review is not validation results and requires actual testing and human sign-off, not a model output. Exam caveat: SecAI+ distinguishes AI as a brainstorming accelerator that proposes STRIDE questions from AI adding those proposed questions to tracking; even when wording says humans still own risk decisions, facilitation is correct. Operational check: treat AI-drafted control validation as unaudited drafts for review, not validation evidence, map each accepted threat to an owner and control, and treat AI prompts as workshop aids that never substitute for elections governance approval.