Trust, but validate: putting AI agents near regulated utility records

If you run records for a water, gas, or electric utility, you have a reflex that the rest of the software world doesn't share: before you trust anything, you ask who's going to ask you about it later. A regulator. An auditor. A litigator. The person across the table during a rate case. That reflex is why "AI for utility records" lands differently than "AI for your inbox."

So it's worth paying attention when Esri — whose ArcGIS platform sits under a large share of the industry's network models — adds a dedicated Trusted AI tab and transparency cards to its ArcGIS Trust Center, and then, in the same breath, tells customers to validate AI results before making decisions.

Use AI to move faster. Validate before you decide.

The posture every serious vendor is converging on

That second sentence is the one people skim past. They shouldn't. It's not a disclaimer bolted on by Legal — it's the actual operating model for AI anywhere near regulated data. The question for utilities isn't whether to validate. It's whether validation is a manual chore you bolt on afterward, or a property the system guarantees by design.

Why the anxiety is rational, not reluctant

There's a lazy narrative that utilities are "behind" on AI because they're cautious. That gets the causality backwards. Utilities are cautious because the cost structure of being wrong is asymmetric in a way most industries never face.

• A mis-located gas main isn't a bad recommendation — it's a dig-in.
• A wrong easement boundary isn't a typo — it's a legal exposure.
• A "cleaned up" asset record isn't tidier data — it's a break in the chain of custody an auditor will walk straight to.

When the downside is measured in safety incidents, consent decrees, and disallowed capital, "move fast and break things" isn't edgy. It's disqualifying.

What Esri's "Trusted AI" tab actually signals

Strip away the branding and the Trust Center move says three things out loud that the whole market is quietly aligning on:

Notice the shape of it. The platform vendor is doing the honest thing — publishing what the AI does and explicitly handing the decision back to you. But "validate before you decide" is a responsibility, not a feature. Somebody still has to build the workflow where validation actually happens, gets recorded, and survives an audit two years later.

The answer: human-checked by design

"Human in the loop" has been said so often it's gone soft. Let's make it mechanical. An agent operating on regulated records should never be the decision — it should draft the decision and stop at a gate it cannot open by itself.

flowchart TD
    A[Agent reads task<br/>+ source records]:::flow --> B[Agent drafts a change<br/>with citations + confidence]:::flow
    B --> C{Confidence &<br/>blast radius}:::flow
    C -->|Low risk, high confidence| D[Queue for review]:::flow
    C -->|High risk or low confidence| E[Escalate to SME]:::risk
    D --> F[[Human reviews:<br/>diff, sources, rationale]]:::human
    E --> F
    F -->|Approve| G[Commit to record]:::good
    F -->|Reject / edit| H[Send back with notes]:::flow
    H --> B
    G --> I[(Append to<br/>immutable audit log)]:::audit
    F -.every action.-> I

Every path — propose, escalate, approve, reject — writes to the audit log. The agent can reach the gate. It can never walk through it alone.

Three design choices make this real, not theater:

1. The agent proposes a diff, never a fait accompli. Reviewers see the before, the after, the source records it pulled from, and the model's stated confidence — the same way you'd review a junior analyst's redline.
2. Risk routing decides who must look. A low-stakes metadata fix and a change to a pressure-zone boundary are not the same event. Blast radius and confidence determine whether it's a one-click approve or a mandatory SME escalation.
3. Nothing commits without an attributable human approval — captured as part of the change itself, not a sticky note in someone's memory.

Guardrails you can read in plain text

"Human-checked by design" should be configuration you can hand to an auditor, not tribal knowledge. A policy file makes the rules legible to a regulator, reviewable in version control, and impossible to quietly override:

version: 1
agent: records-assistant

# What the agent may touch — everything else is read-only.
scope:
  read:    [assets, easements, work_orders, gis_network]
  propose: [asset_attributes, work_order_notes]
  forbidden:
    - delete                 # agents never delete a record of regulated assets
    - pressure_zone_geometry # safety-critical: SME-only, no exceptions

# Nothing commits itself. Approval is always a named human.
gates:
  require_human_approval: true
  auto_commit: false
  min_confidence_to_queue: 0.80   # below this, escalate instead of queue

# High blast-radius changes force a subject-matter expert.
escalation:
  - when: field in [valve_status, main_diameter, service_voltage]
    to: domain_sme
  - when: affected_customers > 50
    to: domain_sme

# Every value the agent writes must cite the source it came from.
evidence:
  require_citations: true
  retain_audit_log: append_only

The point isn't this exact schema — it's that the rules of engagement are explicit, inspectable, and enforced by the system rather than promised in a sales deck.

Audit-ready by design

Here's the part that actually closes the deal with a risk-averse buyer. Validation only counts if you can prove it happened. When the auditor arrives, "we have a careful process" is worth nothing. "Here is the immutable record of the process, per change" is worth everything.

So every agent-touched change should leave behind an entry like this — written once, never edited:

{
  "change_id": "chg_8f3a1c",
  "record": { "type": "asset", "id": "VALVE-44021" },
  "field": "valve_status",
  "before": "unknown",
  "after": "closed",
  "proposed_by": "agent:records-assistant@v1.4",
  "confidence": 0.91,
  "sources": [
    "work_order:WO-2026-0613",
    "inspection:INS-118822"
  ],
  "reviewed_by": "j.ihaia@nutility.example",
  "decision": "approved",
  "decided_at": "2026-06-17T18:24:11Z",
  "reversible": true
}

Read that as an auditor would. You can see what changed, from what to what, which agent proposed it, what evidence it cited, which human approved it, when, and that it can be rolled back. That single object is the difference between "we use AI responsibly" and "here, verify it yourself."

A few properties separate an audit trail that holds up from one that doesn't:

• Append-only. Entries are written, never rewritten. The log of a mistake and its correction is itself the proof of good faith.
• Source-cited. Every machine-proposed value points back to the human- authored record it was derived from. No orphaned facts.
• Reversible. If a change shouldn't have happened, you can undo it and the reversal is logged too — chain of custody intact.
• Queryable. "Show me every agent-proposed change to pressure-zone assets in Q1, and who approved each" should be one query, not a forensics project.

Meeting buyers exactly where their hesitation is

Esri's Trusted AI tab is, in a sense, a tell. The most established vendor in the space is signaling that the way you win utilities isn't by promising the AI is infallible — it's by being transparent about what it does and explicit that the human still decides. That's not a retreat from AI. It's the only posture that scales inside an audited organization.

So when a utility hesitates, they're not being a laggard. They're asking a precise question: when this goes wrong, can I show exactly what happened and that a qualified human signed off? Build the system so the honest answer is yes, here it is — and the hesitation stops being an objection and starts being the reason they choose you.

Trust the agent to do the work. Validate before you decide. Prove it afterward — every time, without trying.

The promise that actually lands

Putting agents to work on your records, with every change human-checked and audit-ready by default? That's the line Nutility is built on. Talk to us about what your audit trail should look like.