A permitting assistant suggests a URL that a backend tool might fetch. Which risk category should the purple team document?

If a permitting assistant suggests a URL that a trusted civic backend might fetch, the purple team should document SSRF-class risk: privileged servers retrieving model-influenced URLs can reach internal services, cloud metadata endpoints, or unintended networks. The risk category attaches when LLM output drives server-side fetches without allow-listing and egress controls, turning a helpful link suggestion into a server-side request channel. Correct documentation focuses on the fetch trust boundary and network policy, not lobby aesthetics. Systematic querying to reverse-engineer model behavior describes model-extraction risk, a distinct class from SSRF; it's about protecting the model's parameters, not about what a trusted backend fetches from a URL. Quoting prior permit applications may raise sensitive-data-disclosure concerns, but it doesn't categorize the risk created when a trusted backend fetches a model-suggested URL. Whether the assistant submits permit approvals for staff signatures is an excessive-agency concern, but it doesn't categorize the risk created when a trusted backend fetches a model-suggested URL. Exam caveat: classify and describe SSRF-class exposure and required controls; do not include live internal URL hit lists or exploit steps targeting city infrastructure in broadly shared reports. Operational check: prevent backends from fetching arbitrary LLM-suggested URLs, enforce allow-lists and network egress policies, require human confirmation for uncommon domains, log outbound fetches from permitting tools with source attribution to model output, and retest with non-routable and internal-looking URL suggestions only in an isolated lab environment.