A utility's outage agent can draft switching orders that move load on the live network. A mistaken order could drop service to a neighborhood. Which control should the architect require before go-live?
Select an answer to reveal the explanation.
Short Explanation
A note that says be careful is not a lock on the breaker panel. You give the agent only the tools it needs and you require a person to approve a switching order before it goes out. Anonymous access would make the dangerous action easier, not safer.
Full Explanation
Security for an agent that can change the live network is least privilege plus a human decision on the consequential action. The agent may draft the order, but the tool that sends it should be callable only by the agent identity, and a qualified person should approve the send. Drafting and sending are different permissions, and only the send moves load on the live network. Instructions that say be careful are not a control. The agent can still call a tool it holds, and a prompt hidden in a work order can argue with those instructions. Anonymous access removes the identity you would need to attribute or stop a run, which is the wrong direction for a storm tool. A public web channel lets people who are not grid operators submit and approve switching language, widening the set of callers instead of narrowing it. Exam caveat: approval belongs on the action that moves load, not on every status question the agent answers. Operational check: attempt a switching send in a test environment with the approver role absent and confirm the order stays unsent.