County IT maps defense-in-depth for a civic AI stack. Which layer set best fits?

Defense-in-depth for a county civic AI stack requires multiple independent layers: data controls, training-pipeline security, serving hardening, and continuous monitoring. Data controls protect labels, features, and resident records through access policy, encryption, and quality gates. Training-pipeline security covers CI/CD identity, artifact provenance, dataset access, and change review so poisoned or unauthorized training cannot silently land. Serving hardening secures inference endpoints, runtime isolation, and configuration. Monitoring detects drift, abuse, and control failure after deployment. No single layer is sufficient; residual risk falls as layers compensate for one another.

A single perimeter firewall with no pipeline or serving controls creates a brittle Maginot line—once bypassed, the AI stack is unprotected. Leaving training and serving wide open because “monitoring will catch everything later” confuses detection with prevention and accepts preventable compromise. A colorful architecture poster with no actual control layers is documentation theater, not defense-in-depth.

Exam caveat: defense-in-depth for AI is multi-stage (data → train → serve → monitor), not just network firewalls. Monitoring complements but does not replace upstream hardening.

Operational check: map each civic AI system to explicit controls in all four layers, identify single points of failure, and verify with tests that data access, pipeline gates, serving hardening, and alerting each function independently under failure of another layer.