Once a plant assistant can call tools—search manuals, open CMMS records, draft work orders—the security boundary is no longer the chat box. It is which functions the model may invoke, for which asset, as which user, and with what confirmation.
CMMS prompt injection into tool calls and embedding drift on RAG indexes are adjacent failures. This note is allowlists and write gates for maintenance copilots.
Separate read from write
Read tools (search SOP, fetch asset history) can be broader if citations and auth still apply. Write tools (create WO, reschedule PM, change priority, close job, edit BOM line) must be deny-by-default. Each write action needs a named permission, a role check against the signed-in technician—not the model—and a human confirm step for irreversible changes.
What belongs on the allowlist sheet
- Tool name and version
- Allowed arguments (asset class, site, max priority)
- Authentication source (SSO user, not free-text “I am the supervisor”)
- Rate limits and after-hours policy
- Audit log fields written on every call
What allowlists are not
They are not a substitute for input sanitization on work-order text. They are not “the model promised it would be careful.” They are not shadow mode that times out into Approve.
A copilot that can talk about a pump should not, by that fact alone, be able to close out the isolation. Gate the tools the way you gate the permit.