A water utility builds an AI feature store mixing customer and sensor data. Which design best fits data management controls?

A water-utility AI feature store that mixes customer billing PII with OT sensor feeds creates concentrated confidentiality and safety risk. Segregating PII customer billing data from OT sensor feeds preserves least privilege, reduces blast radius, and keeps IT privacy controls from being confused with OT integrity and availability requirements. Unifying PII billing data and OT sensor feeds in an encrypted feature store table still co-mingles PII with OT signals in one table, so encryption does not remove the concentrated confidentiality and safety risk of keeping them together. Applying lineage tracking to joint PII billing and OT sensor feature store views still keeps them joined, so lineage tracking does not enforce the separation between privacy-sensitive customer data and operational technology feeds. Tokenizing PII billing fields inside a unified OT sensor feature store table still leaves billing and telemetry together in one unified table, so tokenization does not enforce segregation and anyone with access to the table and token mappings still reaches both sensitive customer data and plant signals. Exam caveat: data-management design for civic AI feature stores should separate highly sensitive personal data from operational technology datasets unless a documented, narrowly scoped join is justified. Operational check: implement separate feature domains or schemas for billing PII versus OT sensors, mediate any approved joins through controlled views, enforce role separation, and retain access logs for utility security and privacy review.