Agentic Systems and AI Integrations
GAIPS · 25 questions
- A city 311 agent can call refund, reopen-case, and email-resident tools under one broad OAuth scope. What should security require?
- County permitting designs a multi-agent planner that shares full applicant dossiers between every agent hop. What change best reduces exposure?
- Transit ops stands up an MCP-style tool server for fare systems without mutual authentication. What should be fixed first?
- A housing casework agent follows a poisoned tool description that directs it to post case notes to an external URL. What risk does this illustrate?
- A public-health orchestrator agent loops indefinitely calling lab lookup tools during an outbreak drill. What control should operators add?
- A court clerk agent persists sealed-case snippets in memory that later appears in unrelated public-counter sessions. What should be corrected?
- A school-district coding agent is allowed unrestricted shell tools on a shared build host. What should security require?
- An emergency-management multi-agent system can publish public alerts without a human approval gate. What control is missing?
- A water-utility agent receives conflicting supervisor prompts and selects the action that skips a safety interlock. What principle failed?
- A library discovery agent can invoke payment MCP tools meant only for fines-desk staff. What should be enforced?
- City security reviews how a 311 agent refreshes OAuth credentials to call resident email APIs. What practice should they verify?
- A parks maintenance agent treats free-text “approve work order” chat messages as authoritative without signed commands. What should change?
- A 311 supervisor agent delegates to subagents without passing purpose and retention limits. What is missing?
- A county assessor agent framework deserializes tool results as code-executable objects. What should security require instead?
- A transit customer agent can use LLM tool calls to reach internal network documentation stores. What control is needed?
- Appsec tests whether MCP and agent tool-protocol messages are integrity-protected in transit. What property is being verified?
- A public-benefits agent stores long-term memory of income documents in a shared vector memory store. What should security prioritize?
- City open-data research agents run in parallel and race-write the same briefing document. What should designers add?
- A housing agent’s planner prompt is editable by case aides in a low-code console. What should security enforce?
- Emergency ops evaluates design options after a rogue agent begins mass-texting residents. What capability is essential?
- A clerk agent chain loses track of which subagent asserted a filing deadline. What property should the workflow preserve?
- Security reviews whether tool allowlists are enforced in the agent runtime or only suggested in prompts. Why does that distinction matter?
- County IT maps inter-agent message schemas to stop agents from invoking payroll APIs on another service’s behalf. What failure is being prevented?
- A transit agent uses unconstrained web-browse tools during peak incident response. What risk should operators weigh first?
- A city CISO requires threat scenarios for agent goal hijacking before a production 311 agent rollout. What is the CISO demanding?