A city authorized web test of the permitting app uses AI to help organize injection test cases. Which practice best keeps the workflow safe and controlled?
Select an answer to reveal the explanation.
Short Explanation
AI is a tidy clipboard for injection families—humans still stamp the hall pass. Unsupervised production spraying and chatbot ROE rewrites are how permitting apps have a very bad Tuesday.
Full Explanation
On an authorized municipal permitting-app web test, AI can usefully organize injection test-case families—grouping reflected vs stored XSS ideas, SQLi variants, or parameter-based checks—so humans can review coverage efficiently. The correct practice keeps AI in the organizer role while humans approve what may actually run against the application. That preserves ROE, change control, and evidence quality on a civic system that often handles sensitive permittee data.
Allowing the model to fire every suggested payload against production without review removes human control and risks availability, data integrity, and out-of-scope impact. Disabling evidence capture to move faster destroys the audit trail owners and counsel need after a city engagement. Replacing ROE with whatever the chatbot recommends mid-engagement treats a model as the authorizing official; ROE is a negotiated control, not a chat suggestion.
Exam caveat: AI-in-web-test items almost always reward human approval of execution, not autonomous production spraying. Operational check: use AI to draft and organize case families, require tester sign-off before any payload runs, keep ROE authoritative, and capture evidence for approved tests.