A housing authority is building a case-triage model. Which architecture decision best strengthens AI security?

Housing-authority case-triage models influence how resident cases are prioritized, so training experiments must not be able to silently alter live inference. Separating training, evaluation, and production inference environments with controlled promotion paths strengthens AI security by isolating mutable experimentation from resident-facing decisions, requiring gated promotion of evaluated artifacts, and preserving a stable production baseline that change control can audit. That segregation is a foundational architecture pattern for municipal AI integrity. Isolating model training clusters in private subnets with automated replication from live inference stores fails because the replication channel re-couples training to production, pulling live resident records and any poisoned inputs into the experiment environment and undermining isolation. Requiring signed approvals for model releases while permitting direct deployment from analyst notebooks fails because notebook-direct pushes bypass the controlled promotion path, allowing unvetted and poorly logged changes to reach serving despite the approval step. Encrypting training snapshots with per-environment keys while mirroring live case records for retraining parity fails because mirroring still pulls resident PII into a less-controlled training environment, so encryption alone does not contain the expanded confidentiality blast radius. Exam caveat: Environment segregation with controlled promotion is the expected architecture control; isolating training in private subnets with automated replication from live inference stores is a distractor, not a security pattern. Operational check: Maintain distinct train/eval/prod workspaces, require controlled promotion with signed releases - not direct deployment from analyst notebooks - before promoting models to serving, and keep experimental copies of case data minimized and access-controlled - not mirrored from live case records for retraining parity even when encrypted.