County permitting adds an AI “suggest documents” widget on the portal. The SOC wants an authorized offensive AI engagement. What should the scope definition emphasize first?

Authorized offensive AI work on a county permitting portal’s “suggest documents” widget begins with a written scope that names AI components—model endpoints, prompts, RAG sources, and integrations—and binds testing to rules of engagement, environments, and escalation paths. A civic MoU or charter-backed purple-team agreement prevents uncontrolled production harm while still allowing meaningful attack-surface validation of the LLM widget. Scope that ignores AI or authorizes unrestricted live exploitation fails both security and public-trust obligations.

Testing live permit environments under claimed MoU constraints still risks corrupting real resident transactions unless the scope itself names non-production or tightly bounded conditions as the primary emphasis, which this option does not establish. Limiting scope to jailbreak and prompt injection tests on the widget UI and citizen prompt handling puts attack techniques before authorization, omitting the model endpoints, RAG sources, integrations, and civic MoU that must be agreed first. Coordinated disclosure to peer municipalities is a sound later-stage practice, but it is a reporting-phase activity, not what the scope definition itself must emphasize first; scope must bind testing and rules of engagement before any disclosure planning happens.

Exam caveat: scope and RoE come first for municipal AI testing; realistic-environment testing without full RoE scope, widget-UI-only jailbreak and prompt-injection scoping, and disclosure planning ahead of scope are not substitutes. Operational check: before testing, confirm a signed MoU lists the widget, RAG corpora, and integrations; names non-production or read-only constraints where needed; and defines stop conditions and vendor notification—then execute only within that charter.