A public library is adding GenAI services. Which control-catalog coverage is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
You need a real control catalog for library GenAI: who can access it, what gets logged, how long information is retained, and how escalation and exceptions work. A welcome banner alone won’t provide those controls.
Full Explanation
A public-library GenAI control catalog should cover access (who may use which tools), logging (what prompts and outputs are retained for oversight), retention (how long logs and derived data live), escalation (when content or privacy issues go to supervisors or legal), and exception handling (who may grant deviations). These controls make GenAI governable in a setting that serves minors and vulnerable patrons and has open-access expectations, while still enabling staff productivity and digital literacy programs. A welcome banner without access or logging controls provides notice, but not access management or auditability. Deleting all logs immediately prevents investigation of misuse, harassment, or privacy incidents. Allowing staff to send patron prompts to any external provider without review or limits risks confidentiality and conflicts with library privacy norms, since prompts can contain patron research and personal details. Exam caveat: logging and retention must be balanced with library privacy commitments; “log everything forever” is not the answer, so retention should be proportionate and access-controlled. Practical check: verify the GenAI services appear in the control catalog with all five coverage areas, confirm role-based access and retention schedules are configured as written, and sample escalation tickets to ensure exception paths are used and recorded.