A county CISO asks which reconnaissance activities stay inside the rules of engagement for a production 311 bot. Which approach is most appropriate?

For a production 311 bot, reconnaissance activities that stay inside rules of engagement use only MoU-approved, low-impact probes and observation techniques that avoid disruptive live exploitation of production workflows. Production civic systems affect real resident tickets and field crews; authorized recon therefore favors fingerprinting, careful capability questions, logging review, and staged environments where possible—escalating intensity only with explicit approval and operational coordination. Running credentialed OpenVAS scans with safe checks against live 311 APIs during business hours fails because active scanning of live production APIs can generate disruptive load, alter service state, and expose real resident data beyond the low-impact, observation-only limits of the MoU. Placing test calls to live 311 operators posing as residents to elicit internal triage and escalation workflows fails because it involves deceptive live social engineering of production staff during real operations, which is disruptive and outside approved passive reconnaissance. Executing controlled prompt-injection payloads against the live ticketing workflow to validate exfiltration paths during peak operations fails because it actively manipulates production workflows at peak load, risking real ticket corruption and resident service disruption instead of passive observation. Exam caveat: Production RoE questions reward non-disruptive, approved methods and punish active scanning of live production APIs, deceptive live social engineering of operators, and live payload injection during peak operations. Operational check: confirm MoU lists allowed techniques and forbidden impacts; use rate-limited probes; coordinate with 311 operations for any higher-risk tests; and keep findings in approved channels until the engagement’s disclosure process—not live pretext calls to 311 operators.