A water-utility agent can create work orders in the CMMS. What defensive control best reduces unchecked impact?
Select an answer to reveal the explanation.
Short Explanation
Letting an agent write straight into CMMS without a human nod is autopilot with a wrench—put approval on high-impact writes. Neon bezels aren’t a control gate.
Full Explanation
A water-utility agent that can create work orders in the CMMS needs human approval gates before agent actions that write to high-impact civic systems. Least privilege may still allow a correctly authorized but misguided or injected agent to open spurious work orders, mis-prioritize repairs, or flood field crews—actions that are 'permitted' yet operationally harmful. Human-in-the-loop approval for high-impact writes inserts a control point where operators validate necessity, location, and safety context before the CMMS commit. That defensive pattern matches the blast radius of physical-world consequences in water utilities. Approval gates complement sandboxing and authz; they address integrity and safety of agent-initiated changes, not only confidentiality. Ocean-themed pump-house murals, custom hard-hat stickers, and neon SCADA monitor bezels fail by concept: facilities décor does not interpose human review before CMMS writes. Aesthetics are not operational control gates. Exam caveat: do not stop at 'least privilege' when the stem emphasizes unchecked impact of agent writes; human approval for high-impact actions is the distinguishing control. Operational check: configure the water-utility agent so CMMS create/update calls enter a pending state requiring authenticated operator approval, log approvals, and test that injected prompts cannot bypass the gate.