A county attorney reviews plans for an authorized AI red team against a live clerk assistant. What governance issue must be settled first?

When a county attorney reviews plans for an authorized AI red team against a live clerk assistant, the governance issue that must be settled first is legal rules of engagement and authorized scope for production civic AI testing. Live municipal assistants process resident matters, touch records systems, and may retain prompts; unauthorized or unbounded testing can itself create privacy incidents, evidence spoliation, service disruption, or liability. Attorney-reviewed RoE should define in-scope hosts and tenants, allowed techniques (prompt injection, tool abuse probes, retrieval probing), forbidden actions (exfiltrating real resident case content, destructive writes), data-handling and retention for test artifacts, stop conditions, notification paths, and time windows that minimize public impact. Only after scope and legal authorization are clear should technique selection and tooling proceed. Authorization-first sequencing protects both the municipality and the testers and keeps offensive AI work aligned with public-sector duty of care. Choosing performance benchmarks for clerk response accuracy and latency thresholds is a measurement decision, not a governance step that settles legal scope or authorization for live testing. Picking technical selection criteria for adversarial prompt libraries and test harnesses before scope is even defined puts tool selection ahead of authorization, which is backwards for a live production system. Setting operational scheduling for low-traffic maintenance and test windows without written authorization treats timing as a substitute for legal sign-off, when unauthorized testing at any hour still creates exposure. What has to be settled first is the legal scope and rules of engagement themselves, before performance benchmarks, adversarial prompt-library criteria, or operational scheduling decisions follow. Exam caveat: candidates may jump to 'adversarial prompt-library criteria' or 'test-harness selection'; the stem asks what must be settled first for a live civic assistant—legal RoE and scope. Operational check: require a signed RoE packet attached to the engagement ticket before any production probe, verify out-of-scope systems are explicitly listed, and confirm a kill switch and on-call municipal contact are named for the test window.