A CVE in an open-source RAG framework affects the parks recreation chatbot. What operational supply-chain practice should the city define?
Select an answer to reveal the explanation.
Short Explanation
Framework CVEs need a patch clock, not a model accuracy benchmark. SLA the fix for the parks chatbot stack.
Full Explanation
A CVE in an open-source RAG framework affecting the parks recreation chatbot requires an operational supply-chain practice: a patch SLA and vulnerability-response process for civic AI application frameworks. Cities inherit CVEs from RAG and agent libraries; without inventory, severity triage, and timed remediation, resident-facing bots remain exploitable after disclosure. Assessments treat delayed framework patching as supply-chain exposure. A model accuracy benchmark and evaluation schedule do not remediate vulnerable libraries.
A model accuracy benchmark and evaluation schedule fail by concept: measuring recommendation quality does not patch frameworks. An embedding refresh cadence for trail description search relevance is relevance tuning, not vulnerability management. A prompt template versioning standard for recreation answer tone and style consistency is output governance, not RAG CVE response. Distractors swap adjacent AI tuning for supply-chain patch operations.
Exam caveat: pinning forever without a patch process creates permanent exposure—pins must be paired with monitoring and an SLA that balances change control against exploitability. Operational check: map the parks chatbot SBOM to the CVE, assign severity and a patch deadline per city SLA, stage the framework upgrade in a non-production tenant with regression tests on recreation Q&A, and verify production images report the fixed version before closing the ticket.