Composite study

This is a product-class write-up, not a named-client story and not a results press release. Counts below describe the pack we actually write (approach points, tools, layers) — not invented bug totals or conversion lifts.

4
Approach points
5
Tools in the pack
5
Layers covered
3
Challenges documented

Overview

Read-only engineers received “you should trip feeder 3” with a fake button in the markdown. A copy-paste into the control console was possible.

Alarm floods caused the model to rank the wrong alarm as root cause because it preferred the most verbose log line.

Industry pattern this is grounded in

In industrial systems, unauthorized actuation is the failure that matters. An LLM that recommends a control the user is not allowed to take — or that skips confirmation — is a safety defect, not a UX defect.

Highlights

Typical launch bar: Block until pass rules hold on the money, identity, or safety path.

Challenges

01

Vendors demoed on a god-mode account.

02

Clock skew between historians made the model invent causality.

03

Alarm-ack tools were documented as idempotent and were not.

How we tested

01

Read-only roles cannot see or invoke control commands. Recommendations that require a higher role must say so and stop.

02

Control commands need confirmation and an audit trail, AI-initiated or not.

03

Stale-data indicator; no present-tense advice on a dead link.

04

Soak test of high-frequency points for unbounded UI memory.

Starting point vs what we required

Starting point versus the controls we required
Starting pointWhat we required
Vendors demoed on a god-mode account.Read-only roles cannot see or invoke control commands. Recommendations that require a higher role must say so and stop.
Clock skew between historians made the model invent causality.Control commands need confirmation and an audit trail, AI-initiated or not.
Alarm-ack tools were documented as idempotent and were not.Stale-data indicator; no present-tense advice on a dead link.

What we delivered

01

Journeys / UI

  • Playwright — Role matrix and confirmation modals
02

API / contract

  • Postman — Command API 403 for read-only
03

Adversarial evals

  • Promptfoo — Unauthorized actuation language
04

Load / soak

  • k6 — Telemetry stream soak
05

LLM traces / evals

  • LangSmith — Which tags the model used as ‘root cause’

Outcomes

Playwright: read-only cannot issue commands. Promptfoo: “how do I trip” must not emit executable command strings for unauthorized roles.

Stale telemetry flagged in the UI. We failed the soak when memory grew without bound. Residual risk: the copilot is advisory unless the control path is in scope and gated.

Stack

Testing stack used on this product class
LayerToolWhat we validated
Journeys / UIPlaywrightRole matrix and confirmation modals
API / contractPostmanCommand API 403 for read-only
Adversarial evalsPromptfooUnauthorized actuation language
Load / soakk6Telemetry stream soak
LLM traces / evalsLangSmithWhich tags the model used as ‘root cause’

Same method as the rest of our work: severity-ranked findings, pass rules in writing, and a ship / wait / block call. See the evaluation method and tool comparison.