A water-utility advisory bot must never emit text that looks like control-system commands. What boundary is the purple team verifying?

For a water-utility advisory bot that must never emit text resembling control-system commands, the purple team is verifying a hard trust boundary between LLM narrative text and operational control actions. Advisory language near SCADA-adjacent environments is dangerous if operators, scripts, or downstream automation can treat free-form model text as setpoints, valve commands, or runbook steps. The correct control is architectural: generative outputs stay in a narrative or advisory plane, while control-plane actions require authenticated, schema-validated interfaces that the LLM cannot write into directly. Assessments probe whether model text can be copy-pasted into operator consoles, whether tools accept natural-language strings as command payloads, and whether detectors flag command-like patterns before display. Confirming a retrieval boundary between curated operations manuals and live telemetry feeds, an authentication boundary separating public users from privileged control-system operators, or a policy filter distinguishing general safety guidance from restricted operational instructions do not create a hard separation between narrative text and operational control actions and are irrelevant to the OT safety boundary being tested. Exam traps frequently dress OT-adjacent AI risks in municipal décor distractors; select the option that hard-separates words from actuators. Caveat: even with a hard boundary, advisory bots can still mislead humans into taking unsafe manual actions, so human-factors review and clear non-operational-advice labeling remain required. Operational check: in an authorized test, attempt to elicit PLC or SCADA-style command strings, confirm they are blocked or heavily flagged, and verify no tool path accepts those strings as executable control inputs.