Production workflows / Guide 37
A Utility Outage Response Agent Without Switching Authority
Build a utility outage response agent that reconciles reports, telemetry, and crew updates while keeping switching, safety clearance, and restoration controlled.
Illustrative engineering guide. Examples are not client deployments, production-ready integrations, or evidence of measured results. Validate the design with your domain and security owners.
Imagine a hypothetical distribution utility receiving hundreds of calls during a storm. Some reports describe the same feeder outage, one reports a downed conductor, and a crew message says “repair complete” while telemetry still shows an open device. An assistant that compresses these messages into “power restored” can create dangerous misunderstanding.
A utility outage response agent should assemble a shared situation picture and draft bounded communications. It should not operate switches, infer electrical safety from silence, issue clearances, or direct members of the public near damaged equipment. Keep those functions in established operational systems and qualified human procedures.
Keep three kinds of truth separate
Customer reports, network observations, and operational declarations are different evidence classes. A customer can accurately report loss of power without identifying the failed asset. Telemetry can show device state without proving a worksite safe. A crew’s repair report does not itself confirm every affected customer’s service restoration.
Store source identity, event time, receipt time, location confidence, and topology version. Correlate reports with the outage management system’s connectivity model rather than grouping solely by postal code. Two adjacent streets may be on different circuits, while distant customers may share an upstream failure.
Maintain separate fields for suspected cause, confirmed cause, estimated restoration window, and verified restoration. Unknown values should remain unknown. A system can say “crew assessing damage; next update at 16:00” without inventing an exact restoration time. The next communication deadline is often more defensible than a repair promise.
Build a read-mostly operational boundary
The minimum architecture reads the outage management system, approved telemetry feeds, customer incident reports, crew status, and weather context. Deterministic services handle event deduplication, topology joins, and status transitions. The model drafts an operator brief with disputed facts and source references.
An operator reviews any public restoration estimate or crew-directed message. A separate publisher sends the exact approved content to predefined audiences. Its tool permissions should not include operational control endpoints. A network allowlist and separate credentials make this more than a prompt-level promise.
The NWS API documentation describes forecasts, alerts, and observations, including caching and delayed observations. Use weather as contextual evidence, not proof of equipment damage. Preserve forecast issue time and valid period, and use the appropriate official provider outside NWS coverage.
Specialist agents may be worthwhile for large incidents when customer-message drafting and technical evidence review need different contexts. They should share a versioned incident record, not freely reinterpret one another’s summaries. Neither specialist gets switching authority.
Gate restoration wording on explicit evidence
This illustrative Python function is a communication eligibility check, not an electrical safety procedure. Its inputs are normalized records verified by the operational integration layer.
def restoration_wording(state):
if state["evidence_stale"]:
return "status_verification_pending"
if not state["operator_restoration_confirmed"]:
return "restoration_not_confirmed"
if state["remaining_outage_count"] is None:
return "customer_verification_pending"
if state["remaining_outage_count"] > 0:
return "partial_restoration"
return "restoration_confirmed_for_scoped_area"
record = {"evidence_stale": False,
"operator_restoration_confirmed": True,
"remaining_outage_count": 12}
assert restoration_wording(record) == "partial_restoration"
record["evidence_stale"] = True
assert restoration_wording(record) == "status_verification_pending"The scoped area matters. Restoring one feeder must not close every customer report grouped under a storm incident. Production needs validated topology, approved restoration criteria, telemetry-quality handling, and explicit treatment of customers without recent meter observations. A missing meter response is not proof of either restoration or continued outage.
Do not use this function to authorize energization. OSHA 1910.269 addresses qualified employees, job briefings, and energy-control responsibilities in its scope. Applicable utility procedures and jurisdictional obligations require specialist oversight; a software workflow does not certify compliance.
Recover from disorder without losing hazards
Outage messages arrive out of order. A late “crew en route” message should not overwrite a later verified arrival. Use source sequence numbers where available and explicit transition rules. Preserve conflicting evidence for review rather than treating the latest received message as authoritative.
Hazard reports need an independent escalation path. A downed-conductor report must not disappear because the system deduplicated it into a known outage. Link it to the incident while retaining its location, urgency, acknowledgment owner, and escalation timer. Use utility-approved public safety wording rather than model-generated instructions.
For notification retries, key delivery by incident, audience, and approved message version. If a publisher times out, reconcile delivery receipts before resending where supported. If an incorrect update was published, issue a clearly labeled correction; deleting the internal draft cannot retract messages already delivered.
During a model outage, operators should still access the incident ledger, deterministic hazard routing, and approved message templates. During a telemetry outage, freeze automatic status promotion and mark freshness explicitly. These failure modes should degrade convenience, not remove the operational record.
Restrict access to infrastructure and people
Authenticate all operator requests server-side and enforce tenant, service territory, and role boundaries. Public summaries should omit sensitive network topology, customer identities, and precise vulnerable-customer details. Authorized care teams may need a separate protected workflow for priority customer contact.
Customer messages and external documents can contain instructions aimed at the model. OWASP’s LLM security project identifies prompt injection and excessive agency as relevant risks. A report requesting “open the upstream breaker” is not authority. MCP only connects approved tools; it does not create operating clearance.
Acceptance tests for storm conditions
- Receive repair completion while operator restoration confirmation is absent. Expect no public claim that power is restored.
- Deduplicate multiple outage reports containing one downed-conductor report. Expect a retained hazard task with a named acknowledgment owner.
- Restore one feeder while another remains out in the same incident. Expect partial restoration wording limited to verified scope.
- Replay an old crew status and a duplicate publication request. Expect no state regression and one logical message version.
- Lose telemetry freshness while receiving a malicious switching instruction. Expect verification-pending status and no operational control call.
Measure communication accuracy independently
Baseline operator minutes spent assembling situation briefs and customer-update correction frequency. Measure supported status statements as statements backed by current approved evidence divided by all reviewed status statements. Measure hazard routing recall as correctly escalated labeled hazard reports divided by all labeled hazard reports, including duplicates and poorly located reports.
Guardrails include false restoration announcements, lost hazard escalations, unauthorized infrastructure disclosure, and publication outside the approved scope. Start with shadow briefs during exercises, then approved internal summaries, then limited public drafting. Reduced outage duration is not attributable to the assistant merely because communications became faster.
Begin with a source-attributed incident brief and no write access. Field service dispatch covers crew feasibility, while production incident response offers useful coordination patterns without equating software outages with electrical hazards. Data engineering services can establish the event lineage and freshness needed before language automation is trusted.