Resident-facing agents need GIS layers from the open-data portal but must not alter authoritative maps. How should tool permissions be designed?
Select an answer to reveal the explanation.
Short Explanation
Public map browsing is a library card, not the keys to the map vault. Give resident agents read-only GIS tools and keep write endpoints away. Letting chat rewrite parcels is a data disaster.
Full Explanation
Resident-facing agents that need GIS layers from the open-data portal should receive read-only tools while mutating municipal map endpoints remain blocked. That permission design lets residents explore parcels, flood plains, or service areas without granting write/delete power over authoritative geospatial systems. Exposing write endpoints to every session, granting database-owner roles, or inventing coordinates in the LLM all violate the separation between public read access and protected map stewardship.
Exposing write and delete map endpoints to every resident session for convenience fails by concept: convenience does not justify allowing chat sessions to alter city maps. Granting residents database owner roles so agents can reshape parcel polygons live is extreme over-privilege and invites catastrophic data corruption. Disabling all GIS access and inventing map coordinates in the LLM response removes grounded geospatial truth and spreads false locations.
Exam caveat: some open-data portals still require API keys and attribution; read-only is not “anonymous unrestricted scrape” if portal terms limit use. Internal authoritative editing tools belong on staff-authenticated agent channels with separate roles.
Operational check: call GIS tools from a resident-agent identity and confirm read layer access succeeds while write/delete endpoints return authorization failures; attempt coordinate invention with GIS disabled and confirm the agent refuses rather than fabricating points.