311 completes abuse testing on a resident chatbot. How should results enter the assurance file?
Select an answer to reveal the explanation.
Short Explanation
Abuse-test results belong in the assurance file so leaders know what was tried and fixed—without posting a how-to guide on the public site. Evidence in, exploit recipes out.
Full Explanation
After 311 completes abuse testing on a resident chatbot, results should enter the assurance file as red-team outcomes without publishing full public exploit detail. Internal evidence shows what was tried, what failed, and what was fixed; withholding step-by-step exploit recipes from the public site avoids handing attackers a manual while still satisfying governance and executive evidence needs for municipal AI.
Publishing full exploit details on the public 311 website creates unnecessary operational security risk and invites copycat abuse against resident services. Discarding findings so engineering velocity stays high destroys assurance evidence and repeats known weaknesses under the next release pressure. Filing only marketing quotes about how secure the bot feels substitutes sentiment for testable outcomes auditors and CAIOs can act on.
Exam caveat: civic AI abuse-test results are controlled assurance evidence—retain them internally, remediate, and do not dump exploit recipes publicly. Operational check: store red-team reports in the assurance repository with access control, link findings to tickets and closures, and scrub public communications of actionable exploit steps while still summarizing residual risk for executives.