During an authorized test of a city library chatbot, what is the purple team evaluating when it runs jailbreak-class prompts against age-restricted content filters?

In an authorized purple-team assessment of a city library chatbot, jailbreak-class prompts are used to evaluate whether age-restricted and policy guardrails continue to enforce content filters when an adversary attempts evasion. The correct focus is control effectiveness under adversarial prompting: do refusal policies, topic filters, and safety layers hold, degrade, or leak under crafted attempts? Evidence from that test class feeds hardening of civic content controls rather than providing a catalog of bypass recipes for public distribution. Whether prompt-injection defenses prevent misuse of backend catalog search tools addresses a separate tool-integration risk, not whether the age-restricted content filter itself resists jailbreak-style evasion. Whether data-loss prevention redaction removes patron account details from responses concerns data confidentiality, not whether the underlying guardrail blocks age-restricted content in the first place. Whether over-refusal calibration preserves availability of allowed youth reference material measures false-positive tuning, not whether the guardrail holds against the prompt at all—a filter can preserve access to allowed material and still leak restricted content under a crafted prompt. Exam caveat: jailbreak-class testing in COASP-aligned civic practice is a controlled T&E activity under authorization and scope; findings describe residual risk and control gaps, not instructions for unrestricted content access. Operational check: confirm test cases are logged against specific filter policies (age, prohibited topics), retest after guardrail updates, and ensure reports omit raw payloads while still quantifying pass/fail rates for leadership and library IT.