During a tabletop, a city red-team pastes jailbreak-style roleplay that asks a benefits chatbot to pretend policies do not apply. What should defenders primarily recognize?

Jailbreak and roleplay prompts try to socially engineer a model into ignoring system or policy constraints—for example, asking a benefits chatbot to pretend policies do not apply. During a tabletop, defenders should primarily recognize that abuse pattern as GenAI alignment bypass behavior, not as evidence of classical network compromise. Recognizing the pattern enables playbook steps: detection, session termination, policy hardening, and proving that enforcement does not rely solely on the model's willingness to comply.

A successful VLAN hop into the benefits database subnet would be a network segmentation breach with different indicators (lateral traffic, credential use). Jailbreak text in the chat UI is not proof of that hop. An untrusted TLS certificate chain is a transport-trust problem evidenced by validation errors, not by roleplay instructions. Replacement of model weights on disk is a supply-chain/integrity incident requiring file integrity and deployment evidence—not demonstrated by pasting jailbreak roleplay alone.

Exam caveat: some jailbreaks fail yet still reveal useful attack surface for monitoring. Policy must be enforced in application logic for benefits eligibility, because model alignment is bypassable. Roleplay is one jailbreak style among many (hypothetical framing, translation tricks, etc.).

Operational check: maintain jailbreak test suites for the benefits bot; detect known bypass idioms; keep eligibility decisions in deterministic services; log and rate-limit abusive sessions; and verify post-jailbreak outputs cannot change benefit determinations. Tabletop outcomes should include control owners for prompt firewalls versus identity versus network—not a single undifferentiated "AI incident" bucket.