Compliance asks how authorized prompt-exploitation tests on a resident-facing bot should intersect with PII handling rules. What is the appropriate design stance?

Authorized prompt-exploitation tests on a resident-facing bot must be designed so data-policy and resident PII handling constraints remain in force throughout: use synthetic or minimized fixtures, scoped environments, retention limits, and access controls. Authorization to evaluate AI behavior does not waive privacy, records, or resident-data obligations. The correct design stance is privacy-preserving T&E that still yields valid security evidence. Requiring detailed audit logs of test queries addresses traceability but doesn't by itself ensure PII handling constraints are respected throughout the testing design, and detailed query logs can themselves retain resident data unless separately controlled. Deferring data-policy checks until after exploitation findings are confirmed and triaged is unsafe: PII handling constraints must be in force throughout the test, not treated as optional follow-up bureaucracy once results are in. Relying on chatbot output filters to redact resident PII rather than constraining test input is a disclosure risk, not a testing virtue: filters can fail, and the test design must keep PII handling constraints in force from the start. Exam caveat: COASP-aligned civic assessments treat privacy controls as part of test design quality, not as optional bureaucracy after exploitation work is done. Operational check: approve a data-handling plan before testing, ban production PII in prompts and logs unless separately authorized and minimized, tokenize any residual identifiers, restrict transcript access, and include privacy compliance in the exit checklist for resident-facing bot assessments.