Library services pull a third-party “municipal AI starter kit” from an unverified registry. What diligence step is most important before adopting it?
Select an answer to reveal the explanation.
Short Explanation
A free starter kit from a mystery shelf is still a software delivery — check who packed it and whether the seal is intact. Provenance and a security look-over beat “ship it to prod and see.” Civic GenAI scaffolding is supply chain, not souvenir swag.
Full Explanation
Third-party "municipal AI starter kits" introduce application-framework and supply-chain risk comparable to other unverified dependencies. Before library services adopt scaffolding from an unverified registry, the most important diligence is verifying provenance (who published it and from where), integrity (checksums/signatures), and completing a security review of the package's default permissions, network calls, and secret handling. Civic GenAI apps should not inherit opaque bootstrapping code that quietly wires plugins, keys, or telemetry.
Installing on production first to measure popularity fails by treating production as a lab and exposing patrons before review. Stripping all licenses so the city can claim sole authorship fails legally and ethically and does not improve security; it also destroys attribution needed for supply-chain accountability. Granting the kit write access to the patron database during evaluation expands blast radius during the exact phase when trust is lowest.
Exam caveat: "municipal" branding in a package name is marketing, not assurance—treat registry popularity as a weak signal next to provenance and review. Operational check: pull the kit only from approved registries, verify signatures or lockfile hashes, review default IAM and outbound calls in a sandbox without patron data, and document accept/reject before any library GenAI app depends on it.