A city AI ecosystem map shows unclear ownership between plugin allow-listing and agent deployment. What control gap should leaders close?
Select an answer to reveal the explanation.
Short Explanation
If nobody owns the allow-list while agents keep shipping, you've got a role gap, not a done-deal ownership structure. Assign the KSAs.
Full Explanation
When an ecosystem map shows unclear ownership between plugin allow-listing and agent deployment, leaders must close a roles-and-KSAs gap. Civic AI control requires named owners for who approves plugins, who releases agents, and who handles exceptions; ambiguous accountability creates bypass paths where agents ship with unreviewed helpers. The correct remediation is clarifying ecosystem roles—not polishing org-chart posters. Governance that separates or explicitly coordinates allow-listing and deployment KSAs reduces shadow IT and audit gaps across departments.
Consolidating authority in one team without separation of duties, delegating approval only to infrastructure without security or developers, and logging decisions in email instead of a centralized audit trail each describe a specific, different governance flaw — but the map's actual finding is that no one owns the roles at all, which these options assume has already been decided one way or another.
Exam caveat: shared ownership without a decisive approver still fails under incident pressure—document primary and backup owners, escalation paths, and break-glass rules for emergency agent changes. Operational check: publish a RACI for plugin allow-listing versus agent release, require dual acknowledgment in the change ticket before production enablement, sample recent agent deployments for allow-list evidence, and remediate any deploy that lacked a named plugin owner sign-off.