Residents want to know why the civic agent answered as it did. How should explainability balance openness and safety?

Residents deserve explainability without exposing unsafe internals: hide internal chain-of-thought but show policy citations and tool names in the explainability UI. Public-facing explanations should reveal what authoritative sources and tools grounded the answer, while withholding raw private reasoning that can leak prompts, private data patterns, or exploitable deliberation. That balance serves openness and safety together for civic agents.

Dumping the full private chain-of-thought into the public UI fails by concept because raw CoT can expose sensitive intermediate content and attack surface while still not being a reliable legal rationale. Showing nothing—no citations, tools, or reasoning hints—fails because total opacity destroys trust and prevents residents from verifying civic answers. Replacing explanations with marketing slogans about “smart city AI” fails because slogans are not evidence and do not support accountability.

Exam caveat: NCP-AAI explainability items often contrast full CoT disclosure, total silence, and marketing fluff with the middle path: show citations/tools, hide private CoT. Prefer that balanced UI design when the stem asks about openness versus safety.

Operational check: implement an explainability panel that lists cited policy IDs and tool names used; scrub/omit raw CoT from resident responses; red-team for prompt-leak via explanation fields; verify clerks can still access richer internal traces under role-based access for oversight.