A new 311 vendor plugin requests filesystem scopes unnecessary for chat replies. What review step should precede enablement?
Select an answer to reveal the explanation.
Short Explanation
Checking vendor checksums before flip-on won't fix overkill permissions—it's like giving a FAQ bot keys to the file room. Scope-check before flip-on.
Full Explanation
Before enabling a new 311 vendor plugin, reviewers must examine and reject excessive permission scopes—especially filesystem access unnecessary for chat replies. Least privilege for municipal chatbots limits blast radius if the plugin is compromised or abused, preventing arbitrary file read/write under the chatbot’s identity. Enablement gates belong before production: scope review, justification of each permission, and denial of filesystem rights that chat replies do not require. Validating checksums does not substitute for that review, as it ensures integrity but not least privilege. Validating checksums and signed releases without actually enforcing scope limits, approving broad scopes on vendor say-so, and deferring scope reduction until usage analytics confirm filesystem calls during live 311 chat operations all let the excessive filesystem scope through rather than rejecting it beforehand — each skips the actual required step of pre-enablement review and denial. Exam caveat: vendors may request broad scopes for “future features”; approve only what is needed now and re-open review when new capabilities ship—standing over-privilege is still a finding. Operational check: parse the plugin manifest for filesystem and host permissions, deny enablement until scopes match chat-reply needs, deploy in a staging 311 tenant with denied filesystem access verified by attempted path reads, then promote only the reduced-scope build.