AI-enabled utility work: separate advisory output from operating authority

Define the utility decision boundary

Name the exact task, system, geography, time horizon, and decision owner. “Use AI for outage response” is too broad. “Prepare a non-operational morning briefing from approved outage and crew-status exports for the restoration coordinator” identifies a bounded input and audience. It does not authorize switching, dispatch, protection changes, public safety instructions, or field work.

Classify the workflow by consequence. Planning support, document retrieval, draft communications, asset prioritization, and control-room operations should not inherit the same acceptance rules. A useful design states what the AI output may inform, what it may never execute, and which existing procedure governs the human decision.

The U.S. Department of Energy's AI for Energy report and programme page identifies potential applications in grid planning, permitting, operations and reliability, and resilience. It also emphasizes safety, security, and responsible deployment. These are opportunity areas and considerations, not approval for a utility's specific system or operating practice.

Sources: [1]

Build the advisory-to-authority register

Create a record for each workflow version with these fields:

The register should preserve timestamps throughout the chain. A correct statement about yesterday's topology can be unsafe if presented as current. Missing telemetry is not a normal zero. A planning model output is not a control instruction.

• Advisory purpose: the question the output is allowed to help answer.
• Operational exclusion: actions and systems the workflow cannot control or authorize.
• Data snapshot: source, owner, coverage, timestamp, quality flag, and latency.
• System state: topology, weather, asset availability, work protection, and known exceptions.
• Transformation: retrieval, classification, forecast, optimization, or drafting step.
• Failure case: stale state, missing telemetry, wrong asset identity, unsafe recommendation, or false certainty.
• Verification: independent source, calculation, simulator, procedure check, or qualified review.
• Authority path: role that may recommend, approve, communicate, dispatch, or operate.
• Stop trigger: data loss, drift, configuration change, incident, or changed operating condition.

Worked artifact: a synthetic storm-restoration briefing

A fictional distribution utility asks an AI assistant to rank restoration work for a morning coordination meeting. The approved input pack contains an outage export from 05:00, a crew roster from 04:30, a critical-facilities list, weather alerts, and yesterday's network diagram.

The first draft recommends sending a crew to a feeder based on the number of affected customers. It misses that the crew roster is stale, the feeder diagram predates a temporary configuration, and the affected site requires a qualification not shown in the roster.

| Register field | Recorded decision | | --- | --- | | Advisory purpose | Prepare questions and priorities for the coordinator's review | | Operational exclusion | No switching, dispatch, crew assignment, or public instruction | | Data snapshot | Each source labelled with owner, extraction time, and freshness limit | | System state | Temporary topology marked unresolved until control-system confirmation | | Failure case | Stale crew status and missing qualification create an unsafe assignment risk | | Verification | Coordinator reconciles current topology, crew status, work protection, and procedure | | Authority path | AI drafts; analyst reviews; authorized operations roles decide and act | | Stop trigger | Source latency beyond limit, conflicting state, missing qualification, or communications loss |

The team changes the output from a ranked dispatch list to an exception briefing. It highlights stale or conflicting evidence and asks the authorized coordinator to resolve it through current operating systems and procedures. The example is synthetic and is not electrical, engineering, safety, regulatory, or operational advice.

Exercise the failure modes before relying on the workflow

Test the actual data path with safe historical, simulated, or approved synthetic cases. Include late telemetry, duplicate asset identifiers, conflicting topology, a forecast outside its trained conditions, a missing critical-facility flag, and an unavailable communications channel. Observe whether the workflow detects the problem, degrades safely, and keeps the human authority path intact.

DOE's Office of Cybersecurity, Energy Security, and Emergency Response describes the Mjölnir AI Testbed as a platform for evaluating AI models supporting energy operations, planning, and grid management, with a focus on security and reliability. That programme demonstrates the relevance of domain-specific testing. It does not validate an individual utility workflow.

Record test coverage by operational condition and failure type. Useful evidence can include data-latency breaches, source-conflict detection, unsafe-action suggestions, false alarms, reviewer corrections, abstentions, and time to escalate. Aggregate accuracy alone can hide rare but consequential failures.

Sources: [2]

Keep operational control outside the advisory layer

Use technical and procedural separation appropriate to the workflow. Restrict data, identities, environments, integrations, and write permissions. Require the existing authorized system of record for current state. Make it clear when text is an AI-assisted draft and which person approved the final communication or action.

Give the workflow a disposition of approve for the defined advisory scope, revise and retest, hold, or exclude. Approval should name the version, safe data path, qualified reviewers, operating exclusions, test set, monitoring owner, and reassessment trigger.

Monitor changes in data and operating context

Reopen the register when topology, telemetry, procedures, vendors, model versions, permissions, weather patterns, operating roles, or data integrations change. Review rejected and corrected outputs, not only successful recommendations. If a failure changes the evidence chain or authority boundary, pause the workflow until the revised design passes its tests.

Assess utility evidence judgment in a bounded simulation

A controlled assessment can provide a mixed-time outage pack, crew records, procedures, an AI-generated priority list, and a deadline. Observable evidence may include whether the participant notices stale state, distinguishes missing from zero, identifies operational exclusions, reconciles sources, routes authority correctly, and communicates uncertainty.

Report only the task-bounded behavior and evidence observed. Do not infer utility authorization, engineering competence, system safety, regulatory conformity, reliability improvement, or future work outcomes from one exercise. Two Prune can organize evidence from a synthetic or explicitly approved non-sensitive simulation. It does not control utility systems, certify operations, or make employment decisions.