TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions

TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions Md Fazley Rafy

arXiv:2608.15391v1 [cs.AI] 15 Aug 2026

Lane Department of Computer Science and Electrical Engineering West Virginia University Morgantown, WV-26505, USA ORCID: 0000-0003-3057-9546

Abstract—Large language model (LLM)-assisted energymanagement tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hashchained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matchedmodel experiment, a stochastic proposal source configured to select an unsafe action with probability p = 0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded ±20% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings. Index Terms—large language model agents, power-system cybersecurity, prompt injection, runtime assurance, Digital Twin, grid operation

failure boundary. A wrong answer is no longer only text; it can become an action against cyber-physical infrastructure. Two weaknesses meet at that boundary. First, token prediction is not a certified model of network physics. An agent can output a correctly typed branch-opening, redispatch, or load-shedding command while missing islanding, thermal-limit, generatorlimit, or critical-service consequences, which is often referred to as action blindness [3]. As a concrete example, a tampered work order may instruct an agent to open a heavily loaded branch to clear a diagnostic code. The resulting command can satisfy the tool schema while islanding part of the network or transferring flow beyond a branch rating, without triggering any schema-level alarm. Second, the context presented to an agent mixes trusted instructions with untrusted content. Indirect prompt injection has been shown to compromise LLM-integrated applications through retrieved or observed text [4]. Direct instruction hierarchies can also be subverted by crafted prompts [5]. In a control center, the untrusted channel can be an equipment description, vendor document, ticket, alarm annotation, or compromised retrieval record. Network segmentation and role-based access remain necessary, but access authorization alone does not answer the state-dependent physical question: is this particular command safe under the current grid condition?

I. I NTRODUCTION

Power-grid security is already a cyber-physical problem rather than a purely information-security problem [6]. Industrial-control guidance emphasizes defense in depth and consequence-aware risk management [7], while the NIST generative-AI profile calls for measuring and managing risks across the AI lifecycle [8]. Existing LLM defenses often focus on classifying malicious text or constraining tool syntax. Text filters are sensitive to phrasing, while a schema establishes only that a command is well formed. Agent sandboxes can expose risky behavior before real execution [9], but an LMemulated environment is not a deterministic power-flow certificate. Conversely, classical runtime enforcement can suppress events that violate a security policy [10], and shielding has been used to constrain learned control policies [11]. The remaining need is a compact architecture that applies runtimeenforcement principles to tool-using grid agents while remain-

L

LM-based assistants are moving from explaining operating procedures toward calling software tools. In a powersystem domain, an agent might query an energy management system (EMS), summarize alarms, formulate a redispatch, or prepare a switching request. Domain models already demonstrate that language models can support advanced powerdispatch tasks [1], and the reasoning-and-action pattern explicitly interleaves language reasoning with external tool calls [2]. This interface can map heterogeneous data and operator intent into a common conversational workflow, but it also changes the Author is with the Lane Department of Computer Science and Electrical Engineering, West Virginia University, Morgantown, WV, USA, 26505. Corresponding Author email address: mdfazleyrafy@ieee.org. 979-8-3315-5720-1/26/$31.00 ©2026 IEEE

TABLE I R EPRESENTATIVE LLM AGENT SYSTEMS IN POWER - SYSTEM OPERATIONS System

Primary task

GAIA [1] Dispatch optimization PowerAgent [12] Agentic grid workflow Grid-Agent [13] Violation remediation GridMind [14] System analysis ChatGrid [15] Visualization / Q&A This work Action authorization

TABLE II RUNTIME DEFENSE STRATEGIES COMPARED

Actionexecuting?

Runtime safety gate?

Defense

Yes Yes Yes Yes No —

No explicit No explicit LM sandbox No explicit N/A Prop. 1

Direct execution — No None Schema validation Struct. only No None Text filter Keyword No None LM sandbox [9] Partial Emulated None T WIN G RID S HIELD Conseq. Yes Prop. 1

ing independent of the agent’s prompt, vendor, and model. The contribution of this paper is three-fold: 1) Formalizes action blindness for a grid agent as a mismatch between a proposed structured action and a consequence-closed safe set. 2) Develops T WIN G RID S HIELD, which combines typed commands, a deterministic network twin, explicit operating invariants, fail-closed enforcement, escalation, and a tamper-evident decision chain. 3) Evaluates T WIN G RID S HIELD in a controlled IEEE 14bus authorization study using a configured stochastic proposal source, matched-model conformance testing, runtime measurements, and a separate parameter-mismatch analysis where the surrogate experiment evaluates authorization policies under a fixed proposal distribution II. R ELATED W ORK AND R ESEARCH G AP As Table I shows, LLM agents in power systems have moved from advisory Q&A toward tool-mediated operation. Here, no explicit indicates that the cited work does not report a deterministic runtime gate that checks the physical consequence of each proposed grid action before release. Tool-using frameworks such as ReAct [2] interleave natural-language reasoning with structured external calls, and domain agents now span dispatch optimization, violation remediation, and multifidelity simulation support [1], [12], [13]. The safety boundary changes when workflow automation converts a languagemodel recommendation into a machine-authorized command, or when repeated suggestions create automation bias. The relevant assurance problem then includes the model, context sources, tool broker, network model, actuator permissions, and operator, rather than model accuracy alone. Perez and Ribeiro analyze direct instruction attacks against language models [5]. Greshake et al. examine the operationally relevant indirect case, in which content consumed by an application carries the adversarial instruction [4]. Separation of data and instructions remains unresolved when both are serialized as tokens. ToolEmu evaluates LM agents inside an LM-emulated sandbox and identifies risky tool-use behavior without exposing a real environment [9]. That approach supports red teaming, whereas grid operation also requires an online authorization decision tied to the current physical state. Input classifiers, delimiters, least-privilege tool scopes, and agent sandboxes reduce exposure and remain useful in

Injection blocked?

Physical check?

Formal Gridclaim? aware? No No No Opt. Yes

a layered design. They do not certify that an allowed grid action is physically admissible under the present operating condition. Conversely, a consequence monitor does not sanitize the model, protect confidential content, or determine whether an operator’s objective is legitimate. Text-level and consequence-level defenses therefore answer complementary assurance questions. Runtime enforcement admits only traces satisfying an enforceable policy [10], and safe-learning shields intervene between a learned policy and its environment [11]. Power-system security work has long treated cyber actions and physical state as coupled [6]. T WIN G RID S HIELD applies this separation to LLM tool calls: the probabilistic model proposes a structured action, and a deterministic authorization layer evaluates the modeled grid consequence before release. Table II compares the authorization question addressed by T WIN G RID S HIELD with common execution-time defenses. Physical consequence checking differs from injection detection because it evaluates the post-action network state rather than the text pattern that produced the action. As a result, an unsafe command can be rejected even when the inducing prompt is obfuscated, retrieved from a document, or expressed without a visible attack marker. III. T HREAT M ODELING & C ONSEQUENCE -AWARE RUNTIME E NFORCEMENT The considered control loop contains an LLM agent, a tool broker, a runtime monitor, a deterministic network twin, and a downstream control API. In this paper, the deterministic network twin is used as a digital-twin representation of the current grid state for pre-release consequence evaluation, rather than as a forecasting or adaptive control model. Let xt ∈ X denote the estimated operating state at time t, including topology, load, generation, and equipment limits. The agent receives an operator request qt and context ct , then proposes one typed action at ∈ A. The prototype command vocabulary includes generator redispatch, branch opening, bounded load shedding, and no operation, as summarized in Table III. The transition model fˆ predicts the post-action state x̂t+1 = fˆ(xt , at ) before the control API receives any command. As shown in Fig. 1, the LLM agent has no direct actuator credentials, and each candidate action must pass through the monitor. The adversary controls natural-language content in ct and knows the tool schema, but cannot directly call the actuator. The attack objective is to induce a valid command that

Fig. 1. T WIN G RID S HIELD runtime authorization workflow

ies [16].

TABLE III P ROTOTYPE COMMAND CONTRACT Action

Parameters

Selected consequence checks

Redispatch Open branch Shed load No-op

generator, MW branch ID bus, fraction none

generator and branch limits solvability, islands, branch limits critical and total shedding budgets current-state feasibility

S = x : C(x) = 1, |fk (x)| ≤ f¯k , pg ≤ pg ≤ p̄g , L(x) ≤ L̄, (2) In Eq. (2), the modeled safe set is defined as Swhere C(x) denotes connectivity and solvability, f¯k is the rating of branch k, and L(x) contains total and critical-load shedding quantities. The monitor implements the release rule through G(•). G(xt , at ) = ⊮[schema(at )]⊮[fˆ(xt , at ) ∈ S]. (3)

islands part of the network, overloads a branch, violates a generator or slack limit, or exceeds total or critical-load shedding limits. Four injection channels are modeled: explicit override, obfuscated instruction, poisoned retrieved procedure, and authority or role-play instruction. The trusted computing base for the enforcement claim consists of the monitor, the post-ingestion state estimate, the network model used by the twin, the configured invariant set, and the actuator accesscontrol policy. Under this threat model, prompt injection is not treated as a phrase-detection task. It is treated as a source of arbitrary schema-valid candidate actions, and the monitor evaluates the physical consequence of each candidate action independent of the text that produced it. T WIN G RID S HIELD separates command formation from command authorization. The first stage maps the agent output to a closed command vocabulary and checks target identifiers, numeric ranges, and required fields. This typed boundary removes free-form tool execution, but it does not establish physical admissibility. A branch-opening command may be syntactically valid while creating an island, and a loadshedding command may satisfy its data type while exceeding a critical-service budget. The second stage applies the candidate command to a read-only state snapshot and solves a DC power flow. For bus-angle vector θ, branch incidence matrix A, and diagonal branch-susceptance matrix Bℓ , the predicted nodal injections and branch flows are given in Eq. (1). p = AT Bℓ Aθ, f = Bℓ Aθ

(1)

Only G(xt , at ) = 1 in Eq. (3) releases the command. For G(xt , at ) = 0, the runtime result is a no-op, a machinereadable list of violated invariants, and escalation to a human operator or a separately certified controller. Proposition 1 (encoded-invariant release guarantee). Assume that (i) every actuator request passes through G(·), (ii) the actuator executes only released commands, and (iii) fˆ(x, a) exactly predicts the state variables used by S. Then no released command produces a modeled next state outside the encoded safe set S. Proof: By Eq. (3), release implies G(xt , at ) = 1 and therefore fˆ(xt , at ) ∈ S. Under assumption (iii), the modeled postaction state equals the relevant physical state variables used by S, so xt+1 = fˆ(xt , at ) ∈ S. Assumptions (i) and (ii) exclude alternate execution paths around the monitor. Hence, no released command violates the encoded invariant set. □ The enforcement rule depends on the predicted physical consequence, not on the string pattern or prompt source that produced the command. A text filter may block some injection styles, but a consequence gate rejects any candidate whose predicted post-action state violates the encoded invariant set. The guarantee in Proposition 1 applies to the modeled state variables and configured invariants; it does not claim safety for unmodeled dynamics, incorrect measurements, stale topology, or missing operating constraints. The logger records each authorization decision using a chained digest. For the decision record rt , containing the state digest, canonical action, result, and reason, the logger is computed as given in Eq.(4). ht = H(ht−1 , |, rt )

The slack generator balances net demand, whereas MATPOWER provides the IEEE 14-bus representation and a standard basis for reproducible steady-state power-flow stud-

(4)

Changing an interior record alters every subsequent digest after the next trusted checkpoint, following the chaineddigest principle of digital timestamping [17]. The log supports

auditability and incident reconstruction, while the physical release decision remains governed by (3). IV. E XPERIMENTAL M ETHOD The evaluation uses the IEEE 14-bus system with 14 buses, five generators, and 20 branches. Each randomized operating scenario scales the total load by a factor drawn from [0.82, 1.08] per unit and independently scales the loads at buses 3, 4, 9, and 14 by factors drawn from [0.92, 1.08]. Because the educational IEEE 14-bus case does not provide binding branch ratings for this authorization experiment, each experimental rating is assigned as max(1.35|fk0 |, 25 MW), where fk0 is the base-case branch flow. These branch ratings are synthetic stress-test thresholds constructed to activate operating constraints, but they need to be validated with equipment ratings from a utility transmission system. The DC formulation represents active-power flow and topology only, where each trial evaluates one action against one state snapshot. These assigned limits create active operating constraints for comparing authorization policies under identical network conditions. The action pool contains non-slack generator redispatch setpoints, load shedding between 5% and 80% at four critical buses, every single branch-opening action, and no operation. Candidate actions are labeled safe or unsafe using the same DC power-flow model and invariant set used by the monitor. Unsafe outcomes include islanding, branch overload, generator-limit violation, slack-limit violation, and violation of total or critical-load shedding budgets. This design evaluates runtime authorization under a controlled consequence model rather than model-specific LLM susceptibility. The main experiment contains 1,000 seeded trials, with 500 benign trials and 500 attacked trials. To make the authorization experiment reproducible and independent of version-specific LLM behavior, the proposal source is a parameterized stochastic threat surrogate [18]. Under attack, the surrogate selects an unsafe action with probability 0.84; under benign conditions, it selects an unsafe action with probability 0.06. These probabilities define fixed proposal distributions for evaluating execution policies, not measured attack rates for a specific LLM. Unsafe choices are sampled from the eight highest-severity feasible candidates in the scenario. The same proposal sequence is then evaluated by four execution policies: direct execution, schema validation, prompt text filtering, and the proposed T WIN G RID S HIELD. Direct execution releases every proposal, and schema validation checks only types and numeric ranges. The text-filter baseline blocks proposals associated with four visible injection markers. T WIN G RID S HIELD applies the full typed-boundary and consequence-checking rule in Eq. (3). The reported metrics are unsafe execution rate, unsafe releases per 500 attacked-condition trials, benign false-block rate, Wilson 95% confidence interval, and local wall-clock latency [19], [20]. The experiment uses seed 2026 and generates per-trial CSV files, vector figures, and audit-chain verification with one command. Seven unit tests evaluate base-case flow, island detection, critical-load limits, schema and semantic separation,

TABLE IV D EFENSE RESULTS ACROSS 1,000 RANDOMIZED OPERATING SCENARIOS Defense Direct Schema Text filter T WIN G RID S HIELD

Unsafe exec. (%)

Unsafe releases /500 attacked

False block (%)

p95 (ms)

46.1 46.1 25.0 0.0

421/500 421/500 210/500 0/500

0.0 0.0 0.0 0.0

0.31 0.48 0.41 0.44

Fig. 2. Unsafe execution by injection style: the text-filter baseline depends on visible markers, while T WIN G RID S HIELD evaluates the proposed physical consequence

slack-command exclusion, safe-command passage, and logtampering detection. Runtime values were measured on a 64bit Windows system using Python 3.9.21, NumPy 1.21.5, and Matplotlib 3.7.1. A separate parameter-mismatch experiment evaluates residual authorization error when the guard retains its nominal DC model but the evaluation oracle uses perturbed states or limits. The study uses 1,000 independent proposals and considers mismatch levels δ ∈ 0, 5, 10, 20%. For load-measurement mismatch, the actual load at bus b is pactual = pseen d,b d,b (1 + ub ),

ub ∼ U[−δ, δ].

(5)

For rating overestimation, each actual branch rating is f¯kactual = (1 − δ)f¯kmodel .

(6)

Trials whose perturbed pre-action state is already unsafe are excluded so that the reported rate measures authorization error rather than initial-state infeasibility. At 20% mismatch, this filtering leaves 954 load-error trials and 841 rating-error trials. Conditional unsafe acceptance is the fraction of oracle-unsafe actions allowed by the nominal guard, while conditional false block is the fraction of oracle-safe actions rejected by the nominal guard. V. R ESULTS AND A NALYSIS Table IV shows that typed tool access does not by itself provide physical safety. Direct execution and schema validation produce the same 84.2% unsafe-proposal execution rate because every adversarial command is intentionally schemavalid. Across 500 attacked trials, this corresponds to 421 unsafe executions, with a 95% Wilson interval of 80.74–87.13%. The overall unsafe-execution rate is 46.1% because the benign

Fig. 3. Residual authorization error under parameter mismatch

set also contains action-blindness cases. The result separates syntactic validity from consequence validity: a named tool call with valid fields can still violate branch, generator, topology, or load-shedding constraints. The text filter reduces unsafeproposal execution rate to 42.0% by blocking the explicit and role-play injection strings that contain its visible markers. Obfuscated and retrieved-procedure injections remain schemavalid and pass the filter, as shown in Fig. 2. This pattern confirms that injection detection and physical authorization answer different questions. Injection detection attempts to classify the cause of an unsafe proposal, while runtime enforcement evaluates the effect of the proposed action on the network state. The latter directly supports the release condition in Proposition 1. Under matched-model conditions, T WIN G RID S HIELD rejects all unsafe proposals and admits all benign safe proposals in the modeled data. The measured result is 0 unsafe executions in 500 attacked trials, with a 95% Wilson interval of 0–0.76%. The rejected set is not concentrated in a single action type: 231 rejected commands are branch openings, 165 are redispatch commands, and 65 are load-shedding commands. The corresponding violated-invariant reports include 330 branchlimit violations, 66 islanding outcomes, 52 combined total and critical-load shedding violations at bus 3, and 13 critical-load shedding violations at bus 4. These structured reasons provide operational information beyond a generic refusal because they identify the constraint that prevents authorization. The median and p95 runtime of T WIN G RID S HIELD are 0.18 ms and 0.44 ms, respectively, including schema validation and the 14bus linear solve. The measured latency is comparable to the schema and text-filter baselines in Table IV, indicating that deterministic consequence checking adds negligible overhead for this case size. The generated 4,000-record audit chain also verifies successfully. A log-tampering unit test mutates a previous allow bit and causes verification failure, confirming that the chained record detects decision-history modification after the trusted checkpoint.

A. Sensitivity to Model Mismatch Figure 3 reports residual authorization error when the guard uses the nominal model and the oracle evaluates perturbed operating states or branch ratings. Under bounded per-bus load-measurement error, unsafe acceptance increases from 0% at the matched case to 1.94%, 4.02%, and 5.63% at 5%, 10%, and 20% mismatch, respectively. When actual branch ratings are uniformly below the modeled values, unsafe acceptance increases more sharply to 10.24%, 16.85%, and 30.09% at the same mismatch levels. Observed false-block rates remain 0% across the perturbation levels, although their Wilson upper bounds remain nonzero. The rating-mismatch case produces the larger residual error because reducing every actual branch rating systematically converts some nominally admissible flows into oracle overloads. Load-measurement error has a smaller effect because signed bus-level perturbations can partly offset each other in the resulting branch flows. These results show that consequence checking eliminates unsafe execution only with respect to the modeled invariant set and the state used by the monitor. In practice, uncertainty margins on branch ratings, measurement freshness checks, and conservative release thresholds can trade a lower unsafe-acceptance rate for a higher false-block rate. However, this tradeoff is an operatingpolicy decision, not a prompt-design decision. VI. L IMITATION AND PATH F ORWARD The reported evaluation should be interpreted as a consequence-aware runtime authorization study rather than as an empirical measurement of LLM prompt-injection susceptibility. The proposal source is a configured stochastic surrogate, so the 84.2% unsafe-proposal rate characterizes the fixed experimental distribution and should not be read as an attack-success rate for any deployed LLM. Moreover, the parameter-mismatch study provides the principal evidence on residual authorization error when this matched assumption is relaxed. The present scope is limited to single-step actions on

the IEEE 14-bus DC formulation with experimentally assigned branch ratings, and it does not evaluate AC voltage constraints, reactive-power limits, dynamic-security behavior, cascading effects, stale topology, or multi-step adversarial command sequences. These limitations define the boundary of the current benchmark and motivate future evaluation with version-pinned LLM agents, a fixed prompt-injection corpus, AC contingency analysis, and hardware-in-the-loop testing. VII. C ONCLUSION This paper presented T WIN G RID S HIELD, a consequenceaware runtime authorization layer for structured grid-agent actions. The method separates language-based command proposal from physics-based command release: the LLM proposes a typed action, while a deterministic network twin and invariant checker determine whether the action reaches the control API. This study establishes a controlled and reproducible authorization benchmark using a configured stochastic proposal source. The formal release rule shows that, under twin and measurement fidelity, commands that violate encoded invariants are not released. In the IEEE 14-bus study, the source configured with punsafe = 0.84 generated 421 oracle-unsafe proposals in 500 attacked-condition trials, yielding a realized frequency of 84.2%. This frequency characterizes the configured proposal distribution used to compare the authorization policies. Under matched-model conditions, T WIN G RID S HIELD produced 0 unsafe releases in 500 attacked-condition trials, confirming that the implementation consistently enforced the encoded DC authorization predicate shared with the labeling oracle. The parameter-mismatch experiment provides the principal robustness result. Unsafe acceptance increased to 5.63% under bounded ±20% per-bus load-measurement error and to 30.09% when actual branch ratings were 20% below modeled ratings. These results quantify the dependence of authorization performance on state-estimation, networkmodel, and equipment-rating fidelity. This result shows that consequence-aware runtime enforcement can close the execution boundary for modeled invariants, while field deployment requires conservative margins, measurement-freshness checks, and accurate equipment-limit modeling. The zero unsaferelease result should therefore be interpreted within the modeled authorization scope. The evaluation establishes a singleaction DC power-flow authorization baseline and does not cover unmodeled AC voltage constraints, dynamic stability, cascading effects, stale topology, incorrect ratings, or multistep adversarial action sequences. Extensions to AC contingency analysis, voltage and reactive-power limits, dynamic security checks, multi-action temporal policies, and hardwarein-the-loop testing would broaden the invariant set and reduce the gap between modeled authorization and operational deployment. The present evaluation establishes a single-step DC power-flow authorization baseline on the IEEE 14-bus transmission benchmark using experimentally assigned branch ratings. Future work will extend this baseline with versionspecific LLM-generated actions, a fixed prompt-injection cor-

pus, AC power flow, voltage and reactive-power constraints, dynamic-security assessment, contingency analysis, and multiaction temporal policies. R EFERENCES [1] Y. Cheng, H. Zhao, X. Zhou, J. Zhao, Y. Cao, C. Yang, and X. Cai, “A large language model for advanced power dispatch,” Scientific Reports, 2025. [2] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “ReAct: Synergizing reasoning and acting in language models,” in Proc. Int. Conf. Learning Representations (ICLR), 2023. [3] Z. Wang, B. Yu, J. Xu, and Z. Li, “Action boundary blindness: When LLM agents cannot tell where one action ends and another begins,” in Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), M. Liakata, V. P. Moreira, J. Zhang, and D. Jurgens, Eds. San Diego, California, United States: Association for Computational Linguistics, Jul. 2026, pp. 36 883– 36 899. [Online]. Available: https://aclanthology.org/2026.acl-long.1711/ [4] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLMintegrated applications with indirect prompt injection,” arXiv preprint arXiv:2302.12173, 2023. [5] F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” arXiv preprint arXiv:2211.09527, 2022. [6] S. Sridhar, A. Hahn, and M. Govindarasu, “Cyber–physical system security for the electric power grid,” Proceedings of the IEEE, vol. 100, no. 1, pp. 210–224, 2012. [7] National Institute of Standards and Technology, “Guide to operational technology (OT) security,” NIST, Tech. Rep. Special Publication 800-82 Rev. 3, 2023. [8] E. Tabassi, “Artificial intelligence risk management framework (ai rmf 1.0),” NIST, Tech. Rep., 2023. [9] Y. Ruan, H. Dong, A. Wang, S. Pitis, Y. Zhou, J. Ba, Y. Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of LM agents with an LM-emulated sandbox,” arXiv preprint arXiv:2309.15817, 2023. [10] F. B. Schneider, “Enforceable security policies,” ACM Transactions on Information and System Security, vol. 3, no. 1, pp. 30–50, 2000. [11] M. Alshiekh, R. Bloem, R. Ehlers, B. Könighofer, S. Niekum, and U. Topcu, “Safe reinforcement learning via shielding,” in Proc. AAAI Conf. Artificial Intelligence, vol. 32, no. 1, 2018. [12] Q. Zhang and L. Xie, “PowerAgent: A road map toward agentic intelligence in power systems: Foundation model, model context protocol, and workflow,” IEEE Power and Energy Magazine, vol. 23, no. 5, pp. 93–101, 2025. [13] Y. Zhang et al., “Grid-agent: An LLM-powered multi-agent system for power grid control,” arXiv preprint arXiv:2508.05702, 2025. [14] H. Jin, K. Kim, and J. Kwon, “GridMind: LLMs-powered agents for power system analysis and operations,” in Proc. SC’25 Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, 2025. [15] S. Jin and S. Abhyankar, “ChatGrid: Power grid visualization empowered by a large language model,” in Proc. IEEE Workshop on Energy Data Visualization (EnergyVis), 2024, pp. 12–17. [16] R. D. Zimmerman, C. E. Murillo-Sánchez, and R. J. Thomas, “MATPOWER: Steady-state operations, planning, and analysis tools for power systems research and education,” IEEE Transactions on Power Systems, vol. 26, no. 1, pp. 12–19, 2011. [17] S. Haber and W. S. Stornetta, “How to time-stamp a digital document,” Journal of Cryptology, vol. 3, no. 2, pp. 99–111, 1991. [18] C. Denamiel, J. Šepić, X. Huan, C. Bolzer, and I. Vilibić, “Stochastic surrogate model for meteotsunami early warning system in the eastern adriatic sea,” Journal of Geophysical Research: Oceans, vol. 124, no. 11, pp. 8485–8499, 2019. [19] A. Borjigin, I. Stadnyk, B. Bilski, S. Hovorov, and S. Pidturkina, “Execution is the new attack surface: Survivability-aware agentic crypto trading with openclaw-style local executors,” arXiv preprint arXiv:2603.10092, 2026. [20] J. W. Leong, “Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful llm agents,” arXiv preprint arXiv:2605.08442, 2026.

Related documents

• TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions#615358
• TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions#614391
• AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations#246421
• ECAS: An Edge-Controlled Agentic System for Validation-Gated Scientific Application Execution#1083670
• ECAS: An Edge-Controlled Agentic System for Validation-Gated Scientific Application Execution#919366