A water-utility chatbot shares authentication boundaries with its vector-store indexes. What should AI reconnaissance include that classic app inventories often miss?

When a water-utility chatbot shares authentication boundaries with its vector-store indexes, AI reconnaissance must include enumeration of those indexes and retrieval trust boundaries as part of the AI attack surface. Classic application inventories often stop at the chat UI or API gateway and miss embedding stores, collection names, retrieval filters, and whether RAG content can escalate into operational knowledge (treatment procedures, network diagrams, credential hints in runbooks). Shared auth means compromise or over-broad identity on the chatbot path may also reach the knowledge plane—exactly what municipal recon should map.

Cataloging of chatbot frontend frameworks and API versions for routine patch tracking fails conceptually as conventional app inventory that overlooks RAG trust boundaries and vector-store indexes. Inventory of operator accounts and shift handover notes to support access review audits fails similarly as traditional access governance rather than AI reconnaissance of retrieval trust boundaries. Mapping of SCADA firewall rules and detailed OT network segmentation for perimeter compliance assessment fails as an OT perimeter task with no bearing on the AI retrieval attack surface created by shared authentication boundaries.

Exam caveat: RAG/vector stores are first-class AI assets on COASP-style exams. When stems stress shared authentication with indexes, prefer enumerating retrieval trust boundaries over non-AI distractions.

Operational check: inventory vector collections, document sensitivity labels, and authZ filters; verify chatbot identity cannot retrieve content beyond policy; and record whether index compromise would expose utility operational data—then align monitoring and least-privilege retrieval controls accordingly.