AI Gateway auth probe

Highest-priority passages

1. 1. Insufficient source coverage — high concern

   Source: Sample Merit System audit excerpt

   Locator: Analyzed ~352 characters

   highCoverage

   The extracted target text is short, so omissions may be overstated and citation quality will be limited.

   Why this is concerning:

   • Human verification needs a fuller source document or OCR for image-only PDFs.

   Recommended action: Provide a fuller document and re-run the scan against your compliance layer.

2. 2. Unmonitored / camera-coverage detail in Sample Merit System audit excerpt — high concern

   Source: Sample Merit System audit excerpt

   Locator: approx. character offset 190 — search target for “camera”

   highStatutory risk

   The target discusses camera, unmonitored, monitoring in a way that may disclose exploitable security or access detail.

   Evidence from target: nts that lack continuous monitoring and camera visibility. Official personnel files are kept in this area. An unmonitored side door near the records room can be used after hours without camera coverag

   Why this is concerning:

   • Publishing where cameras are absent or ineffective can identify an operational vulnerability.
   • It may fit section 10-7-504(i)(1) (and related subsections in the compliance layer): information identifying an operational vulnerability or usable to gain unauthorized access.
   • A human should verify the exact page/lines before redacting or leaving the passage public.

   Citations to verify:

   • section 10-7-504(i)(1)
   • Section 10-7-504(i)(1)(B)
   • Section 10-7-504(m)

   Recommended action: Replace the public copy with a version that removes the location, camera-coverage, access-method, or storage-arrangement details as applicable. Prefer narrow redaction over withholding the entire otherwise-public document when the layer so provides.

3. 3. Physical access / entry-point detail in Sample Merit System audit excerpt — high concern

   Source: Sample Merit System audit excerpt

   Locator: approx. character offset 141 — search target for “entry”

   highStatutory risk

   The target discusses entry, access-control, side door, records room in a way that may disclose exploitable security or access detail.

   Evidence from target: control arrangement identifies specific entry points that lack continuous monitoring and camera visibility. Official personnel files are kept in this area. An unmonitored side door near the records ro

   Why this is concerning:

   • Identifying specific entry points or access arrangements may help unauthorized access.
   • It may fit section 10-7-504(i)(1) (and related subsections in the compliance layer): information identifying an operational vulnerability or usable to gain unauthorized access.
   • A human should verify the exact page/lines before redacting or leaving the passage public.

   Citations to verify:

   • section 10-7-504(i)(1)
   • Section 10-7-504(i)(1)(B)
   • Section 10-7-504(m)

   Recommended action: Replace the public copy with a version that removes the location, camera-coverage, access-method, or storage-arrangement details as applicable. Prefer narrow redaction over withholding the entire otherwise-public document when the layer so provides.

4. 4. Possible missing: Flag disclosures that may be confidential under Tennessee Code Annotated section — medium concern

   Source: Sample Merit System audit excerpt

   Locator: Not located in target excerpt — confirm by full-document search

   mediumMissing requirement

   The compliance layer expects coverage of “Flag disclosures that may be confidential under Tennessee Code Annotated section”, but that concept was not clearly found in the target excerpt.

   Why this is concerning:

   • Layer requirement not clearly evidenced in the target: “Flag disclosures that may be confidential under Tennessee Code Annotated section”.
   • If this requirement maps to section 10-7-504(i)(1), document the gap for counsel.

   Citations to verify:

   • section 10-7-504(i)(1)

   Recommended action: Confirm whether “Flag disclosures that may be confidential under Tennessee Code Annotated section” is required by the layer and add conforming language if so.