City red-team leads must brief leadership on a prompt-attack chain against a municipal assistant. What communication approach fits COASP-aligned civic practice?

COASP-aligned civic practice briefs leadership with a professional attack-chain narrative covering stages, preconditions, and operational impact without including raw jailbreak payloads. Executives need enough structure to fund controls—entry path, privilege or policy failure, civic consequence—while payloads remain in controlled technical appendices with restricted access. Correct communication balances clarity, urgency, and operational security for municipal assistants. Sharing verbatim exploit prompts with leadership to support transparency and review dumps raw payloads into an executive briefing and breaks operational-security rules; leadership needs a staged narrative, not exploit recipes. Publishing detailed attack reproduction steps on the public website to build resident trust exposes the municipal assistant to copycat abuse and is not a leadership briefing; executives need a controlled narrative, not public disclosure. Presenting raw tool logs and model traces to leadership during the executive briefing for technical precision overwhelms executives with low-level evidence and may leak payload material; they need a clear stage-and-impact narrative, not raw traces. Exam caveat: 'without payloads' means the executive narrative omits exploit recipes; technical teams may still retain controlled evidence under evidence-handling rules. Operational check: produce a stage-and-impact brief tied to the municipal assistant's real permissions, attach a restricted technical annex, confirm distribution lists exclude broad all-staff email for payload material, and track whether funded controls map to named chain stages.