AI Agent Governance for Municipal Water Utilities
Governing AI agents in municipal water utilities requires assigning agents distinct machine identities, enforcing least-privilege tool-call permissions at a defined IT/OT boundary, and maintaining immutable audit logs sufficient to reconstruct agent decisions during regulatory or incident review. No water-sector-specific AI regulation yet exists, so utilities must build governance by mapping agent controls to existing frameworks: NIST SP 800-82 for ICS access control, NIST AI RMF for governance functions, and CISA's Cross-Sector Cybersecurity Performance Goals for logging and monitoring.
Where Runtime Enforcement Should Live
-
1
Enforce at the Tool-Call Layer
Governance controls are most effective when enforced at the tool-call layer rather than relying solely on model-level instructions or prompts, which are not reliable enforcement mechanisms in themselves.
Governance Readiness Checklist
- Complete a systems inventory classifying which utility systems agents may access and at what permission level.
- Assign each agent a unique, non-human identity before granting any production access.
- Enforce tool-call restrictions at a gateway or MCP layer rather than at the model level alone.
- Require human authorization for any agent action affecting water quality parameters or control setpoints.
- Structure audit logs to support both incident investigation and public accountability review.
- Align agent governance with existing EPA risk and resilience assessment cycles rather than creating a separate track.
Least Privilege and Human-in-the-Loop Controls
Read-Only vs. Write-Capable Agents
NIST SP 800-82 recommends least-privilege access and role-based access control as core mitigations for ICS environments, and this principle applies directly to agent permissioning. Governance frameworks should draw a hard distinction between agents with read-only monitoring roles, such as an agent summarizing water quality sensor data, and agents with any write or control capability, such as an agent that could adjust a treatment setpoint. These two categories warrant materially different oversight. Any agent action that touches safety-relevant control parameters should require explicit human authorization before execution, not after-the-fact review. This escalation requirement should be documented as part of the utility's governance policy and tested in isolated or simulated OT environments before any production access is granted.
Why Water Utilities Face a Distinct Governance Problem
Water utilities operate at the intersection of public health, physical infrastructure, and increasingly automated IT systems. Agents deployed to summarize sensor data, support maintenance planning, or assist operators sit close to systems where errors carry consequences that go beyond typical enterprise risk. This proximity to SCADA and water quality control systems is what separates governance in this sector from governance in a standard back-office deployment.
No Water-Sector-Specific AI Regulation Exists Yet
There is currently no AI regulation written specifically for water utilities. In the absence of a dedicated framework, utilities are best served by mapping agent governance controls to standards already in use across the sector: NIST SP 800-82 for industrial control system access, the NIST AI Risk Management Framework for governance functions, and CISA's Cross-Sector Cybersecurity Performance Goals for logging and monitoring expectations. Treating these as the baseline avoids building a parallel, disconnected compliance track.
Agent Identity and the IT/OT Boundary
Each agent should be assigned a distinct, non-human identity before it is granted any production access. This identity supports permissioning decisions and makes it possible to trace which agent took which action. Equally important is defining a clear mediation point, an IT/OT boundary, through which all agent requests to SCADA-adjacent systems must pass. This boundary is where least-privilege rules and tool-call restrictions are actually enforced, rather than left to model behavior alone.
Auditability for Regulatory and Public Accountability
Water utilities answer to regulators and to the public they serve. Audit logs for agent activity need to be immutable, timestamped, and detailed enough to reconstruct what an agent did and why, both for internal incident investigation and for external accountability review. Building this logging discipline in from the start is considerably easier than retrofitting it after an incident.
Governance Requirements at a Glance
Distinct, non-human identities per agent for permissioning and traceability.
A defined mediation point all agent requests to SCADA-adjacent systems must pass through.
Read-only defaults, with write access to control parameters explicitly scoped.
Immutable, timestamped records supporting incident reconstruction.
Build Agent Governance on a Runtime Foundation
Trussed AI provides runtime governance and security for enterprise AI agents, including agent identity, least-privilege permissioning, tool approval workflows, and audit logging designed to support the operational controls water utilities need.
Request a Demo