Case File 02 · Energy & utilities
The Grid Scheduler With Standing Admin Rights
A fictional AI agent incident for governance leads in energy & utilities, about AI agent privileged access. Northline Power Cooperative is a distribution utility (fictional). It tests OWASP ASI03 Identity & privilege abuse: the inventory said Rung 0 · advise only, but in practice the agent sat at Rung 4 · physical.
The brief
Northline Power Cooperative is a distribution utility (fictional). Its dispatch-agent-03 plans when grid batteries charge and discharge, and schedules maintenance windows. During the pilot it was given a standing admin account on the operations network to stop permission errors. Nobody took it away. A heat wave is peaking, and you are the governance lead on call.
| Vertical | Electric distribution |
|---|---|
| Inventory tier | Rung 0 · advise only |
| Decisions | 3 |
| Time | about 6 min |
| OWASP agentic risk | ASI03 Identity & privilege abuse |
| Inventory said | Rung 0 · advise only |
| Reality was | Rung 4 · physical |
| Pillars tested | P4 Controls & Human Oversight P2 AI System Inventory P6 Monitoring & Incident Response P5 Transparency & Rights Management P3 Risk & Impact Assessment P1 Governance Architecture |
| In the paperback | Starts on page 187 |
Three decisions
You are the governance lead. Each decision has three options, A, B and C, and each option has a consequence, a pillar and a score. The options, their consequences and the debrief open with the code printed in the Field Manual.
Decision 1 of 3 · Heat wave · 17:41 CT
The load shed nobody saw coming
Customers are off supply and the agent is still active. What do you do first?
Decision 2 of 3 · Day 2 · 09:00 CT
The access review nobody ran
Before the agent goes back into service, how do you set its access?
Decision 3 of 3 · Week 2 · 14:00 CT
Closing it out
How do you close the incident?