Critical Infrastructure

The distance between a helpful answer and an open valve should be enormous. On an operations network it is often one tool call. This starter is for the sites where that gap must be explicit in configuration. The assistant reads and explains. It changes nothing in the field.

A control room supervisor and a reliability engineer want help with runbooks, tickets and status questions. Neither wants an assistant that can touch a relay, a valve or a programmable controller. This configuration holds that line in settings rather than in a policy memo.

Tool control allows runbook search, ticket creation and a status check. It denies shell access, network scanning, external file upload, web requests, remote execution, controller writes, relay tripping and valve control. A session may take two actions, which stops an agent from chaining a long sequence unattended. Generated code is screened for industrial protocol clients, coil and register writes and service stop commands, and a match blocks it. Repeated probing meets automated traffic detection, which refuses a client above six requests in five minutes.

Injection screening rejects a prompt at 0.87. The named attempts include disabling a safety interlock and revealing network topology. Identity must carry a user, an organization, a sector role and a facility. Redaction masks operator badge numbers, vendor contacts, shift rosters, maintenance hotlines, access card numbers and service accounts. A block list refuses control system configuration, network diagrams, facility blueprints, ladder logic, relay settings and historian connection strings. Term rules also refuse instructions to bypass a protection relay, skip lockout and tagout or shed load without dispatcher approval.

Coming back, the answer must reach a combined 0.94, with accuracy at 0.95 and faithfulness at 0.95. The answer must also reach 250 characters and three sentences. A weaker answer is blocked before it reaches the control room. An allow only audit marker then notes that the checks ran on this request.

Redacted capture is enabled, blocked events are recorded, and the gateway stops when capture fails. Safety instrumented systems, physical access control and change management stay outside these settings. The gateway governs the assistant, not the plant. Treat every allowed answer as advice for a qualified operator to check.