Energy & critical infrastructure • customer story

Utility Operator — Safety procedure drafts and incident post-mortems

A Type-III (CRSP-governed) deployment that accelerates safety procedure drafting and incident post-mortems while enforcing strict boundaries: the system drafts documentation and supporting rationale, but never issues operational directives. Outputs remain drafts for accountable review, recorded through Ask → Evidence → Release (AER).

Context

Utility safety and operations teams needed to keep procedures current, consistent, and audit-ready. After incidents and near-misses, post-mortems required rapid documentation with clear timelines, contributing factors, corrective actions, and evidence—without turning AI outputs into operational authority.

Safety procedures Incident post-mortems Regulatory reporting

Type-III wedge

Start with drafting (safe to approve) for procedures, post-mortems, and reporting narratives. Expand into a governance standard across operational AI: common evidence bundling, defeaters, release posture, and audit logs—independent of tools and vendors.

Land → Expand Documentation-first Model-agnostic governance

Boundaries (non-negotiable)

  • No operational directives. No instructions to open/close breakers, reroute loads, or execute field actions.
  • No real-time control posture. The system drafts documentation; it does not run operations.
  • Draft-only posture. Outputs require human safety/officer review and sign-off.
  • Explicit accountable roles. Every artifact names the Safety Owner and Approver roles.
  • Evidence-first. Incident claims must be tied to logs, reports, or approved references in an evidence bundle.
Operational rule: AI may draft procedures and post-mortems, but may not direct operations or replace safety authority.

CRSP architecture (how safety drafting stays governable)

CRSP (Coherent Reflexive Super-Prompt) turns governance into versioned artifacts: safety posture, role boundaries, evidence requirements, defeaters, and release criteria. This makes safety documentation repeatable under review, even during incident response.

  • Context bundle (versioned): safety drafting posture, prohibited directives, required disclaimers, role definitions.
  • Policy layer: allowed artifact types (SOPs, post-mortems, regulator drafts), escalation rules, refusal conditions.
  • Evidence rules: approved sources (incident logs, SCADA summaries if allowed, field reports, safety standards).
  • Defeaters: blocks for operational commands, unverified causal claims, or missing incident evidence.
  • Audit log: immutable record of request, policy version, evidence bundle ID, and release decision.

AER gate: Ask

Normalize the request into a bounded drafting task: artifact type (procedure vs post-mortem), scope, required sections, and explicit “no directives” constraints.

{ "ask": { "domain": "UTILITY_SAFETY", "task": "Draft incident post-mortem (draft-only)", "artifact_type": "incident_postmortem", "audience": "safety_committee", "must_include": [ "timeline (facts only)", "known impacts (bounded)", "contributing factors (clearly qualified)", "corrective actions (proposed, not directed)", "open questions and evidence gaps" ], "must_not_include": [ "operational directives", "real-time control instructions", "unverified root-cause claims stated as certainty" ], "accountable_roles": [ "Safety Officer Reviewer", "Operations Lead Reviewer", "Regulatory Affairs Reviewer (as needed)" ], "policy_version": "crsp.utility.safety.v1" } }

AER gate: Evidence

Evidence is bundled from approved sources (incident logs, field notes, maintenance records, standards references). The draft links claims to evidence bundle items and flags gaps explicitly.

{ "evidence": { "bundle_id": "evb_2026_01_24_045", "sources": [ {"type":"incident_log","id":"INC_LOG_2026_01_14"}, {"type":"field_report","id":"FIELD_RPT_2026_01_14_A"}, {"type":"maintenance_record","id":"MR_2025_12_SUBSTATION_07"}, {"type":"safety_standard","id":"OSHA_ELECTRICAL_SAFE_WORK_PRACTICES_SUMMARY"} ], "notes": [ "State uncertain items as hypotheses", "Flag any missing telemetry or incomplete records" ] } }

AER gate: Release

Release is permitted only when the draft stays in documentation posture, includes required limitations, and passes defeater checks. Otherwise it is blocked or rewritten into a safe, review-ready format.

{ "release": { "status": "APPROVE_FOR_REVIEW", "output_type": "incident_postmortem_draft", "includes": [ "facts vs hypotheses labeling", "evidence-linked claims", "proposed corrective actions with owners", "risk & limitations section", "no-directives disclaimer" ], "defeaters_checked": [ "no_operational_commands", "no_unverified_root_cause_as_certainty", "evidence_linked_claims_only" ], "review_required_by": [ "Safety Officer Reviewer", "Operations Lead Reviewer" ], "audit": { "policy_version": "crsp.utility.safety.v1", "evidence_bundle_id": "evb_2026_01_24_045", "timestamp_utc": "2026-01-24T00:00:00Z" } } }

Defeaters (block or downgrade)

These conditions prevent release or force a safe rewrite:

  • Directive language (“Open/close/energize/dispatch…”) rather than draft documentation
  • Real-time control posture (treating outputs as instructions for operations)
  • Unverified root-cause certainty without evidence references
  • Missing evidence for claims about timeline, impacts, or causal factors
  • Omitted review gates (no named Safety/Operations owners)

Mitigation language (release-safe)

Built-in phrasing patterns that reduce risk and improve reviewability:

  • Documentation posture: “This is a draft post-mortem for review; it is not an operational directive.”
  • Facts vs hypotheses: “Observed facts…” / “Hypothesis pending evidence…”
  • Owner clarity: “Proposed corrective action; owner and due date assigned for approval.”
  • Escalation hooks: “If uncertainty remains, escalate to Safety/Engineering for adjudication.”