A library chatbot returns citation links that leave the city's allowed domains. What should the assessment emphasize?

When a library chatbot returns citation links outside the city's allowed domains, the assessment should emphasize validating and enforcing output allow-lists so generative answers only cite approved civic destinations. Public library assistants are trusted guides; an unconstrained model can invent or surface third-party URLs that phish residents, push malware, or imply official endorsement of unvetted content. Allow-lists and complementary deny-lists applied at generation or post-processing time keep outbound citations inside city, county, partner-library, and vetted research domains that policy has already approved. The finding is about output boundary control for generative assistants, not furniture comfort, typography preferences, or vehicle cosmetics. Inspecting input prompt filters to keep patron queries within approved civic service topics does not constrain which hyperlink destinations the chatbot may cite, reviewing transport encryption for catalog servers does not stop the model from emitting third-party URLs, and auditing training data provenance for public-domain collections does not prevent hallucinated citations outside approved domains; none of these fixes output-domain control or reduces phishing risk from links the chatbot actually sends to patrons. On COASP-style exams, distractors often shift attention to facilities aesthetics when the real defect is unsafe handling of model-produced URLs. Caveat: allow-lists must be maintained as services move domains or add partners; overly brittle lists can break legitimate research citations, so include a documented exception and review path for librarians. Operational check: run a controlled prompt suite that requests external references, capture every emitted URL, and verify each hostname resolves only to entries on the approved civic link allow-list before the answer reaches the patron UI.