A water utility exposes Claude tools near plant operations. Which tool-set construction fits?

Near water-plant operations, Claude tool sets must follow least capability: expose read meters and draft notices so the model can summarize telemetry and prepare communications, but do not expose valve actuation, even when gated behind a confirmation prompt in Claude. That split keeps AI assistance in the information plane while licensed operators retain control actions. Exposing meter reads with valve actuation behind a confirmation prompt in Claude still couples benign reads to high-impact writes in the same agent surface, and a prompt injection can trick the model or an operator into confirming an unsafe change. Exposing meter reads and drafting valve schedules for automated evening execution creates physical safety and compliance risk from a single mistaken or injected schedule that runs unattended. Exposing meter reads alongside scoped valve testing tools for calibration flows still places physical valve operations behind a conversational interface, outside the interlocking human procedures utilities require for calibration work. Exam caveat: even draft-notice tools can cause harm if they auto-publish without review—least capability includes approval gates on outward communications. Operational check: inventory the tool manifest presented to Claude, confirm no valve tools are listed—including actuation behind confirmation prompts, schedules for automated evening execution, or scoped testing tools for calibration flows—attempt a prompt that requests a valve change and verify refusal or absence of such a tool, and ensure meter-read tools are read-only at the API layer.