Research into two-party agentic delivery
Intended use, safety relevance, validation evidence, and boundaries on consequential action.
AAO-020 / Governance and Accountability
Utility boards should decide what authority remains with the operator before buying an agentic service. Delegation, behavioral freedom, operating conditions, and intervention are separate decisions that require evidence appropriate to essential service.
AAO-014 / Data, Technology, and Security
Infrastructure managers should authorize provider agents through task-specific identities and tested revocation. Initial use should remain limited to approved low-risk support, with operational engineering defining how access can be withdrawn safely.
AAO-015 / Resilience and Exit
Infrastructure providers should sell a defined support service with explicit authority limits and demonstrated recovery. The offer must explain its dependencies and evidence without implying that cybersecurity guidance certifies autonomous critical control.