City recon discovers three undocumented departmental LLM wrappers. What is the correct follow-through?
Select an answer to reveal the explanation.
Short Explanation
Finding mystery LLM wrappers is like finding unmarked keys on the city ring—add them to the key log, assign owners, and watch them. Don't file them in a departmental wiki with informal checks, and don't just approve them as vendor SaaS under central procurement. A software catalog entry with API-gateway metrics isn't enough either; they need the municipal AI asset register.
Full Explanation
When city recon discovers three undocumented departmental LLM wrappers, the correct follow-through is to update the municipal AI asset register and bring the wrappers under inventory, ownership, and monitoring. Undocumented wrappers are shadow AI: they may hold API keys, touch resident data, or call municipal systems outside central policy. Recon’s job is to make the real estate visible so governance, logging, RoE, and controls can cover what is actually deployed.
Documenting the wrappers only in departmental wikis while retaining local control with periodic informal checks fails conceptually: local wiki entries and informal checks do not provide municipal AI asset register inventory, clear ownership, or continuous monitoring. Registering the wrappers as approved vendor SaaS products under central IT procurement management fails because it treats shadow wrappers as ordinary procurement without first establishing AI-specific ownership, data-flow mapping, and monitoring in the municipal AI asset register. Cataloging the wrappers in the municipal software catalog and tracking usage through existing API gateway metrics fails because generic software catalog entries and API metrics do not capture AI-specific ownership, secrets handling, or the governance required by the municipal AI asset register.
Exam caveat: Shadow-wrapper discovery items reward inventory and ownership updates, not departmental wiki control, blanket SaaS approval, or generic catalog and API-gateway tracking.
Operational check: register each wrapper with owner, environment, keys/secrets vaulting status, and data flows; rotate any exposed credentials privately; enroll endpoints in monitoring; and schedule policy onboarding rather than confining them to departmental wikis, generic SaaS approval, or software-catalog-only tracking.