# OT/ICS Agent Risk & Containment Review (Draft) ## A. Review snapshot - **Status:** Draft design-review aid. No source excerpts were supplied, so there are no SOURCE-STATED labels. - **Scope:** Water-treatment SCADA and Modbus TCP PLCs. The assistant reads exported pump historian trends and maintenance logs and proposes a weekly inspection schedule to an engineer. Protocol-specific behavior is UNKNOWN. - **Claimed authority:** Observe/propose. No declared write access and no work-order issuance. This is a claim, not verified evidence (G01). - **Connectivity:** UNKNOWN. The exporter writes to a read-only JSON staging folder in an IT analysis zone. No air-gap credit is given and no full-network exposure is assumed. - **Asset/interface evidence:** Versions, patch status, allowlists, query limits, simulation coverage and safeguard verification records are all UNKNOWN. - **Assumptions and conflicts:** "Read-only" describes the staging folder, not the exporter's path back into OT. "Independent" protective functions are asserted without records. Because autonomy evidence is missing, any possible write path is analyzed only conditionally. - **Next step:** Resolve G01, G02, G08 and G09 in a design-review session before any scope expansion. ## B. Risk register | ID | Category | Trigger and mechanism | Credible consequence | Evidence and basis | Priority and rationale | Controls / gap | |---|---|---|---|---|---|---| | R01 | Data exposure | Staging folder or assistant output readable beyond the intended audience | Disclosure of process telemetry and maintenance data | DERIVED (system context: data in IT zone), IT-zone placement widens access | Medium: informational, bounded | C2, C11, C12; G02 | | R02 | Irreversible action | Engineer accepts a flawed schedule, for example deferring a pump inspection, and a later work order follows | Hard-to-reverse equipment damage. Requires a human acting on the advice, with no direct actuation | DERIVED (agent brief: proposes to engineer) | High: physical consequence, but human-gated | C6, C12; G12 | | R03 | Financial/resource overrun | Over-frequent or unbounded inspection proposals, or unbounded history queries | Wasted maintenance effort, compute or staging load | DERIVED (brief) | Medium: bounded resource impact | C13; G07 | | R04 | Privilege/scope creep | Tools or credentials later added that reach OT or enable work orders | Unintended write or order authority | DERIVED (brief: write access "no declared"; evidence missing). Conditional only | Unknown: pathway cannot be characterized | C11, C2; G01 | | R05 | Injection/untrusted input | Instruction-like or falsified text in maintenance logs, or manipulated trend values | Skewed schedule or leaked data, with a path to R02 | DERIVED (brief: reads logs). Schema checks alone are insufficient | High: manipulates advice that reaches physical decisions | C5, C12 | | R06 | Availability/shared resource | Exporter or queries load the historian or PLC polling | Delayed telemetry, or engineers over-relying on the assistant | DERIVED (system context: exporter reads historian) | High if shared with operational services, otherwise Medium. Currently UNKNOWN | C13, C3, C1; G07, G11 | | R07 | Compliance/policy | Unresolved jurisdiction and site policy | Possible unmet requirements. No framework is named or presumed | UNKNOWN (jurisdiction not supplied) | Unknown: applicability unestablished | G04 | | R08 | Cascading/multi-agent | Corrupted export or model/prompt change propagates into schedules and downstream records | Correlated bad schedules across assets | DERIVED (system context: single exporter feeding the assistant). No multi-agent path supported | High: correlated shared dependency | C8, C12; G09 | | R09 | Physical-process safety | Assistant misreads pump state, lacks process constraints, or relies on stale data | Plausible but hazardous recommendations if acted on. Requires human acceptance | DERIVED (brief) | High: safeguard independence is unverified | C6, C12; G08 | | R10 | Privilege/scope creep (extra: exporter) | Exporter compromise or misconfiguration that bridges OT and IT | Tampered data or a return path into OT | DERIVED (system context: exporter spans zones) | High: cross-zone bridge | C2, C3, C10; G03, G09 | ## C. Containment plan (all tests NOT RUN; all rows PROPOSED) | Control | Risks | Proposed requirement | Owner | Acceptance test (NOT RUN) | Evidence required | |---|---|---|---|---|---| | C1 | R06, R09 | Keep the assistant outside any real-time or protective loop. The control engineer supplies timing budgets | Control engineer | Confirm no control or protective function depends on assistant output | Architecture diagram; timing budgets | | C2 | R01, R04, R10 | Define and enforce the IT/OT boundary and dedicated exporter interface independently of the model | OT network engineer | Attempt out-of-policy flows from the analysis zone and confirm denial | Zone map; firewall rules | | C3 | R06, R10 | If selected, keep export strictly one-way. Any return route is a separate approved path | OT network engineer | Verify no reverse-direction traffic from the staging side | Exporter design record | | C5 | R05 | Authenticate tools, separate untrusted log content from instructions, and enforce authorization outside the model | Security engineer | Inject instruction-like log text and confirm no tool or scope change | Tool inventory; test logs | | C6 | R02, R09 | Preserve independent protection. Provide an external revocation mechanism and a site-engineered isolation procedure. The agent has no authority over protection | Safety/control engineer | Revoke agent access in a review exercise and confirm protective functions are unaffected | Safeguard verification records | | C8 | R08 | Version and integrity records for the model, prompts, tools, exporter configuration and releases, with named drift reviewer | AI governance lead | Check that a changed prompt or configuration triggers review | Release inventory | | C10 | R10 | Inventory touched components, versions and patch evidence against site-approved baselines | Asset owner | Reconcile inventory against actual versions | Asset/patch register | | C11 | R01, R04 | Deny-by-default gateway with endpoint, protocol, operation and identity allowlists, plus decision logs | Security engineer | Confirm unlisted endpoints and operations are blocked and logged | Allowlists; gateway config | | C12 | R01, R02, R05, R08, R09 | Controlled staging, explicit input schema, bounded output schema, and deterministic checks. Format validity is not semantic safety | Data engineer | Feed malformed and out-of-schema inputs and confirm rejection | Schema specs | | C13 | R03, R06 | Site-defined TTL and call/query budgets with an external circuit breaker that alerts an owner. No silent retry | Platform owner | Exceed a budget and confirm revocation and alert | Budget definitions | ## D. Open items | Gap | Scope | Missing/conflicting fact | Required artifact | Owner | Effect | |---|---|---|---|---|---| | G01 | R04 | Autonomy and write-path evidence | Credential and tool-access inventory | Security engineer | R04 stays Unknown | | G02 | R01, C2 | Connectivity and zone placement | Network diagram | OT network engineer | No isolation credit; exposure unbounded | | G03 | R10 | Asset versions and patch status | Asset/patch register | Asset owner | Cannot judge currency | | G04 | R07 | Jurisdiction and applicable policy | Site compliance mapping | Compliance owner | R07 Unknown | | G05 | R01, R04 | Network allowlists | Gateway/firewall rules | Security engineer | C11 unverifiable | | G06 | Scope | Validated simulation coverage | Twin coverage record | Process engineer | Relevant only if authority expands | | G07 | R03, R06 | Query limits | Budget and limit config | Platform owner | Contention unassessed | | G08 | R02, R09 | Safeguard independence verification | Verification records | Safety engineer | Residual risk Unknown | | G09 | R08, R10 | Exporter direction and integrity | Exporter design | Data/OT engineer | Return path unexcluded | | G10 | C9 | Isolation credit withheld: no air-gap or analogue-only segment described | Detailed isolation description | OT network engineer | C9 not linked | | G11 | R06 | Control and polling timing | Timing budgets | Control engineer | C1 unquantified | | G12 | R02 | How schedules become work orders | Workflow description | Maintenance lead | Human-gate strength unknown | **Coverage note:** All nine categories are included (R01–R09). **C4** is excluded because no actuation is proposed. A twin does not establish safe actuation, and G06 applies if scope changes. **C7** is excluded because no multi-agent path is supplied. **C9** is not linked (G10). C1, C2, C3, C5, C6, C8, C10, C11, C12 and C13 are selected. ## E. Engineering handoff 1. **Evidence collection:** Close G01, G02, G03, G08 and G09, since these determine R04 and R10 priority. 2. **Design changes:** Put a deny-by-default gateway (C11) and strict staging schemas (C12) in place, and confirm the exporter is one-way (C3). 3. **Independent review:** Have an authorized engineer, independent of this draft, review safeguard independence and the exporter boundary. Nothing here indicates readiness. This is a risk-scenario and containment-rule draft, not a safety case, SIL determination, certification, compliance verdict, deployment approval, or operating authority.