Power utilities and energy

The agents map one to one onto four utilities patterns, tested in the line of business and OT layer (R05). The patterns did not test equally. One has a measured result, one has outside support, and two have no published production precedent. So each agent carries its own evidence status, following decision D017 in the decision log.

The business opportunity

A distribution feeder trips and recloses three times in one week. Each event reaches the control room as a burst of alarms. Last month's aerial imagery shows vegetation close to one span on that feeder. The asset register and the map system disagree about which pole stands at that span. The last inspection record is two years old.

Before a crew goes out, staff must join five sources. They are the alarm history, the imagery, the map, the asset records and past inspections. The crew then needs the right procedure and the history of that site. After the job, what the crew found should correct the asset register. The work and its records must also hold up when the regulator asks about them later.

That is one path from a concern to inspected work. Four agents can help along it, each matching one R05 pattern.

The estate

A distributor of about one million customers in Australia or New Zealand runs systems in all fourteen layers. The table names the main ones. Vendors in brackets are examples, not a claim about any named utility. The table is industry knowledge, not a survey.

This blueprint covers the distributor. In Australia and New Zealand the retailer bills households, so billing, payment plans and hardship sit with the retailer. Victoria's distributors own the household smart meters, so they also run the meter head-end and meter data.

Three records must agree: the GIS network model, the asset register and the market's standing data. They often do not, and the gap drives exceptions. The historian is the safe copy of OT data for an agent to read. The utilities page draws this estate as a building, with the market boundary at the edge.

Process maps

Each worked example maps the work on this estate, step by step. It shows the process today across these systems, then the same work with an agent. It names who approves, where, and what the agent reads and writes.

• Prioritize vegetation inspections: the distributor's own work. Imagery platform, GIS, the asset system, outage management and field mobility. The agent writes one proposed notification.
• Resolve billing exceptions without deciding hardship: the retailer's work, on the other side of the B2B e-Hub. It shows the market requests that reach the distributor and the metering coordinator.
• Investigate a water-network anomaly: the same information path rule for control systems, at a water utility.
• Build an AI use inventory a regulator can read: one row per AI use, drawn from the agent registry.

Start with the simplest useful solution

Compare the agent with scheduled inspection, GIS rules, and conventional condition monitoring. Use the same representative cases and count human review, errors, integration, and ongoing operation. Add an agent only where choosing what to investigate or handling varied evidence improves the result.

Fixed logic already does the autonomous part of grid operation well. Duke Energy's self-healing grid acts alone in production. This guide reads it as rules-based, not an agent (see the named deployments below). Agents earn a place on the information path around such systems, not inside them.

Proposed responsibilities

SCADA (supervisory control and data acquisition) is the control-room system that monitors and remotely operates field equipment. Assisted (A1) means the agent helps a person who does the work. Delegated tasks (A2) means a person reviews every output. Fixed (L0) means the agent does not learn. Curated learning (L1) means people update what it knows, offline. Reviewed learning (L2) means it proposes its own updates and people review them. Both scales are on the autonomy contract. The autonomy and learning positions are proposals. They are starting choices to test, not certification levels.

Start with one agent and ordinary tools. Separate a responsibility only when it needs different permissions, independent review, or its own operating schedule.

Event context agent: Pattern A, supported with two corrections

R05 found real support for agents that review alert streams with work-order and event context. A process-control vendor shipped guided alarm response with an oil major on 1 October 2024 [vendor]. A refinery pilot in November 2025 gave operators twelve minutes of notice on pressure disturbances [vendor]. Both are process plants, not electric utility control rooms.

The first correction: the suggestion already ships, so the part worth designing is the validation loop. Build it before the suggestion. Each candidate reading is checked against live telemetry, open work orders and the asset's history. A reading that fails a check is dropped or shown as unverified. Only then does the operator see it, and the operator decides. Where a simulation of the network exists, run candidate actions through it too. The national-lab control-room reference architecture does this and never shows the model's raw answer (R05 validation loop).

The second correction: "control always stays human" is a policy, not an industry fact. Reinforcement-learning agents hold closed-loop control at two named process plants. They are bounded, simulator-trained and run with the safety system untouched. That is a different discipline from a language-model agent. This guide recommends that control authority stays human for language-model agents. Closed-loop AI control is a separate exercise with its own safety case.

Asset reconciliation agent: Pattern D, the only measured result

It is the only one of the four patterns with a measured result. In national-lab work, a language model converted control-room network models into planning models in under a minute. Staff usually take multiple weeks for that task. The converted model met the applicable model-validation standard. The specialist still checked the result (R05 measured result).

The write-back gate is the real decision, not the reconciliation. Asset register changes flow into the regulated asset base (rate base in the US), conformity evidence and regulatory reporting. So the gate needs provenance and the same change control the sector already applies to its models. A named data owner approves every write. No field that feeds the regulated asset base should run at supervised autonomy (A3).

The other half of the flywheel is capture: every work order returning real condition data. That is an operating-model and incentive change, not an AI capability. It should be stated that way, or it will be sold as something a tool can deliver.

Field assistance agent: Pattern C, no published production precedent

No production deployment of a contextual safety coach was found. The nearest published work is a June 2026 research prototype. It links permits, safety enforcement data and complaints into job-site hazard notes. Its authors call it a benchmark study and decline to claim fewer injuries. Essential Energy said in April 2026 it was preparing an AI that reads crew notes for safety signals. Its 76 percent detection figure is a projection, not a measurement (iTnews, 16 April 2026).

The caution is automation bias. A retrieval agent can anchor a crew on the last accident. Experienced crews read the site with their eyes, ears and nose, and one confident history can crowd that out. Decision support that is usually right measurably reduces how often people check it (R05 human factors). Show why each past incident matched. Say plainly when nothing close matched. Never present a past incident as today's hazard.

Vendors assert how field agents behave with poor connectivity. None specifies it. Specify and test it before deployment.

Compliance verification agent: Pattern B, a design proposal with no published precedent

This pattern was demoted to a design proposal. The North American reliability body has described AI assisting compliance monitoring, with staff reviewing flagged cases. But adoption of that approach in the sector's own survey was 2 percent. No compliance-automation vendor has a named utility customer in the published record. The industry conversation runs the other way, toward auditing the AI.

The agent itself likely falls under critical-infrastructure information-protection rules. An agent that reads protected cyber system information triggers information-protection obligations. Its model and configuration become change-managed baselines. Inside the security perimeter, the access and system-security requirements apply to it. The published workaround is to run open-weight models locally with no public network access. Anyone building this is building something new.

Switching and protection

No utility was found letting an AI agent operate protection or switching. The switching assistant gathers approved procedures and nothing more. Switching authority stays in the approved control system and with the operator.

If a customer agent is added

This blueprint has no customer agent. If one is added, AER v Origin (6 July 2022) sets the line. Automated processes changed hardship payment plans without checking capacity to pay. Origin paid an A$17 million penalty. So a customer agent may answer and flag hardship signals. Any change to a payment plan, balance, tariff or debt goes to a trained person. Capacity to pay is checked case by case. That puts the agent under the rule for decisions about people and beside the movement of money zone. Such an agent should sit at delegated tasks (A2) and curated learning (L1).

Named, dated deployments

These are the anchors this blueprint is measured against. Outcomes are as reported by the party named. Almost none is independently audited. Sources are under External reading.

Capabilities used

The seven capabilities are what an agent platform provides. What an agent platform provides sets them out.

Controls and human decisions

Keep switching, protection, and physical control in approved control systems. Let the agent prepare evidence and proposed work. Test operation when connectivity fails.

Give every tool call a task identity, a limited permission scope, and a recorded result. Before a write, check that the source record has not changed. Stop when required evidence is unavailable, the task budget is reached, or a proposal exceeds the authorised scope.

The named enforcement points, by agent:

• Every agent. Its own identity and a named sponsor, recorded through the agent lifecycle. A tier from the risk profile. Any agent that reads control-system data is Tier 3 (strict). A tested path back to manual or rule-based control.
• Event context agent. The validation loop runs before display. Output appears in the alert channel, visually distinct from configured alarms. It is never credited as a protection layer. A brokered read path is defensible while output stays as alerts. If any output could reach a control action, use a one-way architecture instead (R05, CD-18).
• Asset reconciliation agent. The write-back gate: a change request with source records and timestamps, approved by a named data owner. The register applies the change, not the agent. This sits in the formal regulatory records zone.
• Field assistance agent. Poor-connectivity behaviour specified and tested before deployment. Match reasons shown. "No close match" stated when true. Crew location and performance data never used to judge a person.
• Compliance verification agent. Runs inside the perimeter on locally hosted models with no public network access. Its model and configuration are change-managed baselines. Staff review every flagged case. A named person attests every record.
• Switching assistance. Read-only access to approved procedures. No path to the control system. This is the safety actuation zone.

A useful investigation loop

Observe the exception, identify the missing fact, request that evidence, and check whether it changes the proposed action. Repeat only while there is a concrete unanswered question. End with a reviewed proposal, a confirmed result, or an explicit request for human help.

For the event context agent, the loop ends with the validation check, not with the suggestion. A suggestion that has not passed the check does not reach the operator as advice.

Economics and measures

Economics

Value here is counted in specialist hours, avoided truck rolls, deferred asset replacement and avoided outages, not in tokens. The one measured result shows the shape: weeks of specialist work done in minutes, with the specialist still checking. Data access is the constraint on the other side. An industry research body puts roughly 95 percent of utility data behind cybersecurity and customer-privacy walls (R05).

Use cost per run to control spend. Use cost per resolved outcome to decide whether the agent stays. Agree the baseline with the process owner. Count value only after the outcome is confirmed. Compare the value of recovered time and better outcomes with the full cost. The full cost covers tools, models, evidence preparation, supervision and correction.

What proves it is working, and what proves it is not

Measure confirmed defects, missed risks in a sampled control set, inspection lead time, unnecessary visits, and crew review effort. Add the R05 measures:

• Alarm-to-action time, with the operator verification rate beside it.
• Recommendation acceptance and override rates.
• Register correction throughput and rejection rate.
• Work-order data completeness. This is the operating-model measure.
• Time to revert to manual, tested.

Signs it is not working: acceptance rises while verification falls, which is automation bias. Proposed corrections keep being rejected. An unverified reading reaches an operator. Crews report that the matched incident did not fit the job. The revert-to-manual test has not been run.

Honest limits

Decision D028 makes this section mandatory. This blueprint had the longest limits section in the corpus, and that length was the finding. The full length is restored here.

What does not work

• Imagery can be old, obscured, or too coarse to establish clearance. Treat detection as a reason to inspect. Confirm asset identity and current conditions in the field.
• Agent output cannot count as an independent protection layer. A highly managed alarm needs a defined proof test, and a probabilistic output cannot meet one.
• Advice that is usually right makes people check less. Acceptance rate alone cannot show whether the agent helps.
• One confident matched history can narrow what a crew notices on site.
• Vendors do not specify how field agents behave with poor connectivity. They assert it.
• Most utility data sits behind security and privacy walls. An agent cannot reason over records it cannot reach.
• The capture half of the asset flywheel is a change in how work orders are filled in. No tool delivers it.

What has no published precedent

• Pattern B, compliance verification. No named utility, no named vendor customer.
• Pattern C, the contextual safety coach. No production deployment. The nearest work is a research prototype whose authors make no outcome claim.
• Language-model triage of SCADA alarms. None was found anywhere in the October 2026 research.
• A production AI alarm-triage deployment in an electric utility control room. The published work is research, refinery pilots and product announcements.
• A measured AI outage result at any Australian or New Zealand network operator for 2024 to 2026. None was found.

What this guide refuses to claim

• That any utility lets a language-model agent operate protection or switching. None was found, and this blueprint proposes none.
• That any utility lets a language-model agent change a payment plan on its own. None was found.
• A much-quoted figure of 43 percent fewer billing exceptions at a US utility. It could not be found in any source checked, including the vendor announcement of 11 September 2026. It is left out.
• That adoption is mature. A PwC study reported in April 2026 found 61 percent of utilities still in test or pilot. None called themselves advanced. This was read through a consultancy's summary, not the study itself.
• That "control always stays human" is an industry fact. It is a recommendation for language-model agents.
• That the CAISO deployment is proven in production. Production is the vendor's word. CAISO reported no results in July 2025.
• That the AER bulletin was read in full. The bulletin itself timed out. Its content here rests on a law firm's alert.

Limits to test

Evaluate ordinary cases, uncommon failures, conflicting evidence, and recovery after an interrupted action before expanding authority. Test the validation loop with readings designed to fail it. Test the write-back gate with a correction whose source record changed mid-review. Test each agent with its network connection cut.

External reading

The workflow above is the guide's proposal. These sources support the general investigation and risk-management methods; they do not validate the proposed business result.

• ReAct: reasoning and acting with language models, 2022. Research basis for alternating reasoning and tool use.
• NIST AI Risk Management Framework, 2023. General framework for managing AI risks.

Sources reviewed 17 September 2026.

• Government guidance on integrating AI in operational technology, December 2025. Additional reading for deployments that interact with industrial systems.

Pattern evidence, reviewed 19 August 2026.

• R05 findings: the four utilities patterns, tested, August 2026. The evidence status of Patterns A to D.
• R05 sources, accessed 19 August 2026. The dated primary sources behind each pattern.

Named deployments and regulator sources, reviewed 14 October 2026.

• Duke Energy announcement, reproduced by StockTitan, 5 February 2026. Operator-reported self-healing results.
• Latitude Media on the CAISO outage-review pilot, 28 July 2025. CAISO's own status: no results yet.
• OATI field lessons, 2026. Vendor statement of production and the overnight review figure [vendor].
• Schneider Electric Grid AI Assistant, via Eurelectric, 4 June 2026. Actions stay subject to user review [vendor].
• K&L Gates on the AER automated-bidding bulletin, 10 August 2026, on the bulletin of 5 August 2026.
• Tapestry on Vector, 20 August 2025. Pole inspection times, using Vector's data [vendor].
• Race for 2030 on AgenticGrid, undated, read October 2026. The Broken Hill trial.
• IBM case study: AGL, undated. Chat containment [vendor].
• Region, reporting the AER release on Origin. The Federal Court hardship penalty of 6 July 2022.
• iTnews on Essential Energy, 16 April 2026. A projected, not measured, safety-signal result.
• IBM announcement of 11 September 2026. Checked for the 43 percent figure; it is not there.
• innobu summary citing PwC, updated 26 September 2026. The 61 percent adoption figure, reported April 2026.