A water-utility SCADA machine-learning agent has standing privileges to write plant setpoints without human confirmation. What AI-related vulnerability should the auditor flag?

Flagging excessive identity and access privileges that allow autonomous civic AI agents to write critical setpoints emphasizes least privilege for water-utility SCADA machine-learning agents. The correct vulnerability works because standing write access without human confirmation lets a faulty or compromised agent alter plant setpoints with immediate physical-process impact. Municipal AI agents that can act on operational technology need constrained roles, confirmation gates, and monitoring commensurate with safety consequences.

Prompt injection through historian chat queries manipulating advisory summaries for shift operators fails because it targets operator-facing advisory content rather than the agent's standing write privilege to critical SCADA setpoints. Training data poisoning from tampered pressure logs skewing leak detection thresholds fails because it concerns data integrity and model inputs, not the excessive identity-and-access privileges that let an autonomous agent write critical setpoints. Model drift in demand forecasts reducing prediction accuracy across seasonal usage patterns fails because it describes forecast degradation over time, not the excessive standing write rights of an autonomous agent on operational technology.

Exam caveat: human confirmation controls can be bypassed under alarm floods if operators rubber-stamp prompts; confirmation UX and dual control matter. Operational check: remove standing write rights where feasible, require authenticated human approval for setpoint changes, log agent proposals versus executed writes, and test that the water ML agent cannot unilaterally alter critical SCADA setpoints.