311 operations finds duplicate chatbot agents in the municipal CMDB with unclear ownership. What should the AI security program require?

When 311 operations finds duplicate chatbot agents in the municipal CMDB with unclear ownership, the AI security program must assign authoritative owners and reconcile inventory so each municipal AI agent has clear accountability. Ownership is the prerequisite for access reviews, change approval, incident response, and retirement; duplicates without owners become orphaned risk. Reconciling the CMDB removes shadow instances and ensures monitoring and policy attach to real agents. Leaving duplicate agents running as backup personalities increases attack surface, confuses residents with inconsistent answers, and preserves unmanaged credentials. Deleting the CMDB and relying on verbal knowledge among supervisors destroys the authoritative register and guarantees ownership will stay tribal. Assigning ownership only after a resident complaint makes accountability reactive and allows unmanaged agents to operate until harm is visible. Exam caveat: ownership should be a named role with a backup, not a shared mailbox that no one monitors. Operational check: reconcile CMDB AI entries against production endpoints and API gateways, assign a primary and alternate owner per agent, retire or merge duplicates, and schedule periodic ownership attestation.