A city is choosing a model for code-enforcement FAQs. Which selection approach best fits AI lifecycle security management?

Code-enforcement FAQ models do not automatically require the largest public general LLM. AI lifecycle security management favors selecting a smaller domain-tuned model matched to the FAQ use case and risk rather than defaulting to the biggest general model. Right-sizing improves controllability, often reduces data-exfiltration and cost surface, and forces explicit fit-for-purpose evaluation against municipal sensitivity instead of assuming scale equals safety.

Always picking the largest public general LLM regardless of municipal data sensitivity fails because model scale is not a substitute for data-handling fit, residency, or controllability. Skipping model selection criteria and adopting whatever a single vendor demoed last week fails by replacing lifecycle evaluation with sales momentum. Choosing models solely by marketing token-per-dollar slides with no security review fails conceptually—unit economics without security review omit confidentiality, integrity, and abuse considerations.

Exam caveat: Lifecycle model selection is risk- and use-case-driven; 'largest LLM' and demo-only choices are weak answers on AAISM-style items.

Operational check: Document selection criteria (use case, data sensitivity, residency, eval metrics), compare a right-sized domain-tuned candidate against larger generals on those criteria, and require security review before procurement—not demo-only adoption.