A water utility allows a GenAI assistant to query operational metrics but must prevent unsafe free-form SQL from the model. Which control reduces that risk?

When a water utility GenAI assistant may query operational metrics, unconstrained free-form SQL from the model is dangerous. The control that reduces that risk is constraining text-to-SQL tools to allow-listed deterministic query shapes so the foundation model cannot emit arbitrary unsafe statements. Deterministic templates (parameterized reads against approved views) let the assistant read gauges without granting a generative path to destructive or exfiltrating SQL.

Allowing the model to execute any generated SQL, including destructive statements, without review fails by concept: FM output is not a trustworthy query author for production OT/IT data stores. Granting the GenAI role unrestricted DDL privileges on all utility databases fails least privilege and expands blast radius to schema-destroying operations. Disabling query tools entirely and requiring operators to memorize every metric offline fails usability; the goal is safe tooling, not no tooling.

Exam caveat: allow-listed shapes should run with a read-only database role, row and column constraints appropriate to the requester, and timeouts. Determinism means the tool selects among approved queries—it does not mean the FM invents DDL that you then sanitize with brittle string filters alone. Log tool invocations for plant after-action review.

Operational check: attempt metric questions that map to allow-listed templates and confirm successful reads; attempt prompts that solicit DROP, UPDATE, or unrestricted SELECT across sensitive tables and confirm the tool rejects them; verify the GenAI execution role lacks DDL and broad write privileges on utility databases.