A clerk-agent review finds no allow-lists on document-destruction tools. What assessment activity produced that gap?

Finding no allow-lists on document-destruction tools during a clerk-agent review is the result of security review and gap analysis of the civic agent tool catalog. Irreversible actions such as shredding, purge, or retention-clock resets require explicit allow-lists, dual control, and purpose checks because a compromised or confused agent can destroy evidentiary or statutory records. Catalog gap analysis inventories every tool, its privileges, missing guards, and whether high-impact capabilities are reachable from low-trust chat contexts. That activity is how assessors surface missing allow-lists before an incident, not by auditing clerk dashboard roles and staff access permissions, reviewing retention schedules for archived civic records storage, or red-team testing of clerk chatbot prompts for injection vulnerabilities. Auditing clerk dashboard roles and staff access permissions, reviewing retention schedules for archived civic records storage, and red-team testing of clerk chatbot prompts for injection vulnerabilities do not evaluate agent tool risk. Exam items often hide the assessment method among municipal busywork; choose tool-catalog security review and gap analysis. Caveat: allow-lists alone are insufficient without authentication of the requesting identity and immutable logging of destruction events for later legal discovery. Operational check: export the agent tool catalog, flag irreversible tools lacking allow-lists or approval gates, and verify a test destruction call is denied unless the caller and record class match an approved policy entry.