A water IT lead reviews an AI agent wired to vulnerability scanner output. Which constraint correctly reflects typical municipal ROE?
Select an answer to reveal the explanation.
Short Explanation
Summarize the cracks in the dam report—do not start swinging sledgehammers because a chatbot felt confident. Context yes, unauthorized auto-exploit no. That is the water-utility ROE in one line.
Full Explanation
When a water IT lead reviews an AI agent wired to vulnerability scanner output, municipal ROE typically allows contextualization and summarization but forbids unauthorized auto-exploitation. The agent may help operators understand findings, map them to assets, and draft remediation narrative; it must not auto-exploit outside authorized analysis, especially near OT or water-process networks where availability and safety dominate. That constraint keeps AI inside decision-support rather than unsupervised offensive automation.
Auto-exploiting every critical finding overnight without human approval violates change control and can impact treatment or distribution support systems. Rewriting ROE mid-scan to include OT controllers when convenient is not how authorization works—scope changes require governance, not agent initiative. Replacing human verification whenever confidence scores look high confuses model confidence with operational correctness; confidence is not authorization or validation.
Exam caveat: water and other civic OT-adjacent environments are used to stress that AI aggressiveness must stay below ROE ceilings. Summarize and prioritize; do not unsupervised-exploit.
Operational check: configure the agent without exploit plugins or autonomous exploit tools unless a separate purple-team charter exists; require human approval gates before any exploit-like action; log all agent recommendations versus actions taken.