Critical Infrastructure Governance

AI Agent Governance for Municipal Water Quality Monitoring Systems

Municipal water utilities deploying AI agents to monitor sensors and analyze contamination data need runtime policy enforcement, scoped agent identities, and detailed audit logging before any agent is permitted to interact with SCADA or process control systems. No AI-specific federal regulation currently addresses this directly, so utilities must extend existing OT cybersecurity frameworks from CISA, EPA, and NIST to cover autonomous agent behavior, distinguishing advisory actions from operational commands and requiring human approval for anything that can alter treatment processes.

Talk to an Expert Explore Runtime Governance

Governance Requirements at a Glance

Four foundational controls define whether an AI agent deployment is safe to introduce near water quality monitoring and control infrastructure.

Agent Identity

Distinct, scoped credentials separate from human operators or service accounts.

Runtime Enforcement

Policy checks applied to every tool call before it reaches control systems.

Least Privilege

Separation between read-only monitoring and operational command authority.

Audit Logging

Captured inputs, policy decisions, and executed or blocked actions for incident review.

Where Runtime Controls Belong in the Architecture

AI agents should never connect directly to SCADA or control interfaces. A policy enforcement layer sits between the agent and the control system, evaluating each tool call before it is allowed to execute.

1
Policy Enforcement as a Mediation Layer
Every tool call an agent attempts is intercepted and evaluated against defined policy before it can reach a control interface, rather than being executed directly against SCADA systems.

Governance Decisions to Make Before Deployment

Before any agent is connected to monitoring or control workflows, utilities should resolve the following decisions.

Assign each AI agent a distinct, scoped identity separate from human operator or service account credentials.
Define which agent functions are advisory versus operational, and enforce that separation at the permission level.
Deploy a policy enforcement layer that intercepts and validates every tool call before it reaches control interfaces.
Confirm IT/OT network segmentation isolates agent compute environments from SCADA networks.
Require human approval for any AI-initiated action that could alter treatment processes.
Ensure agent audit logs capture input data, policy evaluation results, and executed or blocked actions.

Why Water Quality Monitoring Is a Distinct AI Governance Problem

Water utilities occupy a unique position in critical infrastructure: sensor and analytics systems increasingly rely on AI agents to flag anomalies, but any pathway from analysis to process control (valve actuation, chemical dosing, pump operation) introduces physical safety consequences that most enterprise AI governance models were never built to address.

No AI-Specific Regulation Exists Yet, But Frameworks Still Apply

Neither the EPA's America's Water Infrastructure Act (AWIA) risk assessment requirements nor CISA's cybersecurity performance goals were written with autonomous AI agents in mind. Both, however, apply to process control cybersecurity generally, and utilities are expected to extend that existing coverage to agent behavior rather than wait for AI-specific rulemaking. NIST's AI Risk Management Framework offers additional guidance on the human-approval expectations that follow.

Defining Risk Tiers for Agent Actions

Not all agent actions carry the same risk. Advisory actions, such as alerts, trend summaries, and contamination analysis, do not change physical processes and can typically run with lighter oversight. Operational actions, such as commands that adjust chemical dosing or actuate a valve, directly affect treatment outcomes and warrant a stricter permission tier with mandatory human approval before execution.

Auditability for Incident Reconstruction

When an incident occurs, investigators need to reconstruct exactly what an agent observed, what it attempted, and what was allowed or blocked. Audit logs should capture the input data the agent acted on, the result of each policy evaluation, and a record of every executed or blocked action, not just a summary of outcomes.

Where Trussed AI Fits

Trussed AI provides the runtime policy enforcement layer described throughout this guide: a mediation point between agents and control systems that evaluates tool calls, enforces scoped identities, and produces the audit trail utilities need for both regulatory alignment and incident response.

Frequently Asked Questions

Do EPA or CISA rules specifically regulate AI agents in water utilities?

No. EPA's AWIA risk assessment requirements and CISA's cybersecurity performance goals apply to process control cybersecurity generally, not AI agents specifically. Utilities must extend these existing frameworks to cover agent behavior since no AI-specific water sector regulation currently exists.

Should an AI agent ever have direct write access to SCADA systems?

Direct access is not recommended. A policy enforcement layer should sit between the agent and the control interface, validating every tool call and routing operational commands through a separate approval path rather than granting the agent unmediated control system access.

What is the difference between advisory and operational agent actions?

Advisory actions include alerts, analysis, and trend summaries that do not change physical processes. Operational actions include commands like valve actuation or chemical dosing adjustments. These require different permission levels and, per NIST AI RMF guidance, human approval before execution.