A public-works agent tool SDK auto-updates overnight and bypasses the city's pinned security review. What supply-chain control failure is that?
Select an answer to reveal the explanation.
Short Explanation
Auto-updating past the security pin is like swapping locks without telling facilities. Freeze versions until review catches up.
Full Explanation
When a public-works agent tool SDK auto-updates overnight and bypasses the city’s pinned security review, the failure is uncontrolled auto-update risk in the civic AI tool supply chain. Automatic updates can introduce unreviewed code, new permissions, telemetry, or vulnerable transitive libraries into municipal agent tools used for field workflows. Controls include version pinning, staged promotion through test environments, mandatory re-review after any SDK change, and disabling silent updater channels on production hosts. Fleet cosmetics do not restore change control.
An incomplete SBOM that omits transitive dependencies in civic agent builds is a documentation gap, unsigned artifact promotion that skips signature verification for civic AI tool releases is an integrity gap, and overprivileged tool scope that grants broad civic agent permissions beyond task needs is an authorization gap — none of them is the uncontrolled auto-update that lets code change without the city's required security re-review, which is the actual failure being tested.
Exam caveat: unsigned artifact promotion still needs signature verification and a city-defined acceptance window—blind trust in upstream releases can import unreviewed civic AI tool code.
Operational check: freeze SDK versions in the public-works agent images, disable vendor auto-updaters, require a change ticket and security re-review before bumping the pin, and verify production hosts report the approved digest after overnight maintenance windows.