TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions

Md Fazley Rafy

cs.AIAug 15, 2026

TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions

Authors: Md Fazley Rafy

Organizations: Lane Department of Computer Science and Electrical Engineering, West Virginia University, Morgantown, WV, USA, 26505

Abstract

Large language model (LLM)-assisted energy-management tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hash-chained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matched-model experiment, a stochastic proposal source configured to select an unsafe action with probability p=0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded +20% and -20% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings.

Figures & tables

System	Primary task	Action-	Runtime
		executing?	safety gate?
GAIA [ 1 ]	Dispatch optimization	Yes	No explicit
PowerAgent [ 12 ]	Agentic grid workflow	Yes	No explicit
Grid-Agent [ 13 ]	Violation remediation	Yes	LM sandbox
GridMind [ 14 ]	System analysis	Yes	No explicit
ChatGrid [ 15 ]	Visualization / Q&A	No	N/A

TABLE I: Representative LLM agent systems in power-system operations

Defense	Injection	Physical	Formal	Grid-
	blocked?	check?	claim?	aware?
Direct execution	—	No	None	No
Schema validation	Struct. only	No	None	No
Text filter	Keyword	No	None	No
LM sandbox [ 9 ]	Partial	Emulated	None	Opt.
TwinGridShield	Conseq.	Yes	Prop. 1	Yes

TABLE II: Runtime defense strategies compared

Action	Parameters	Selected consequence checks
Redispatch	generator, MW	generator and branch limits
Open branch	branch ID	solvability, islands, branch limits
Shed load	bus, fraction	critical and total shedding budgets
No-op	none	current-state feasibility

TABLE III: Prototype command contract

Fig. 1: TwinGridShield runtime authorization workflow

Defense	Unsafe	Unsafe releases	False	p95
	exec. (%)	/500 attacked	block (%)	(ms)
Direct	46.1	421/500	0.0	0.31
Schema	46.1	421/500	0.0	0.48
Text filter	25.0	210/500	0.0	0.41
TwinGridShield	0.0	0/500	0.0	0.44

TABLE IV: Defense results across 1,000 randomized operating scenarios

Fig. 2: Unsafe execution by injection style: the text-filter baseline depends on visible markers, while TwinGridShield evaluates the proposed physical consequence

Fig. 3: Residual authorization error under parameter mismatch

Tool Access Control for LLM Agents

Tool access control for LLM agents limits which tools, resources, and actions agents may use, and under what conditions.

See all 208 papers

A Governance-Aware Large Language Model Orchestrated Agentic Digital Twin for Transmission System Operator Control Room Decision Support
Sep 18, 2026Costas Mylonas, Magda Foti, Emmanouel VarvarigosAI Agent Governance Language Model-Based Control
LLMs and Agentic AI Systems for Smart Grids: A Tutorial on Architectures and Applications
Jul 20, 2026Daniela Rojas, Abdulwahab Albassam, Aidan G. Leung +11LLM Agent Orchestration LLM Agent Evaluation
Department of Electrical and Computer Engineering, University of California San Diego, La Jolla, CA, 92093, USA · Department of Electrical and Computer Engineering, University of Alberta, Edmonton, AB, T6G 1H9, Canada
Evaluating Jailbreaking Vulnerabilities in LLMs Deployed as Assistants for Smart Grid Operations: A Benchmark Against NERC Standards
Apr 25, 2026Taha Hammadia, Lucas Rea, Ahmad Mohammad Saber +2LLM Jailbreak Attacks LLM Safety Evaluation
ECE Department, University of Toronto, Toronto, ON Canada · CIISE, Concordia University, Montréal, QC, Canada

Sep 18, 2026J/K move · Enter open · S save

A Governance-Aware Large Language Model Orchestrated Agentic Digital Twin for Transmission System Operator Control Room Decision Support

Costas Mylonas, Magda Foti, Emmanouel Varvarigos

AI Agent Governance Language Model-Based Control Tool Access Control for LLM Agents LLM Safety Benchmarks

Open paper AskPDF arXiv

Transmission system operators face rising complexity from renewable integration, reduced inertia, and tighter security margins. Large language models offer natural-language decision support, but their hallucinations, uncontrolled tool use, and weak traceability conflict with control room requirements. This paper presents a governance-aware agentic digital twin for transmission grid control rooms. The large language model only selects and parameterizes whitelisted analysis tools, and every proposed action passes through a governance layer that the model cannot bypass. The layer enforces four rules on every run. Only whitelisted tools execute. No run exceeds its step budget. No action with side effects executes without explicit operator approval. Every number in an answer is rendered by the layer from backend results with its unit, variable, and time. The rules are checked on a persistent audit trail for every run of a released 118-task benchmark, which covers analytics, simulation, multi-step workflows, and twelve families of adversarial inputs on a digital twin of the Greek transmission network. Across 590 runs of the primary model, tool selection reaches 96.5% and task success 93.7%, and all four rules hold without exception. In a separate three-repetition study across four large language models, 1416 runs in total, the rules again hold on every run, with an approximate 95% lower bound of 99.8%. Removing the layer makes the same model execute all 45 approval-requiring runs without authorization and leaves only 39.2% of its answers with backend-supported numbers. Enforcement costs 12 to 16 milliseconds per request.

Abstract

Tool Access Control for LLM Agents

Explore similar work

A Governance-Aware Large Language Model Orchestrated Agentic Digital Twin for Transmission System Operator Control Room Decision Support

LLMs and Agentic AI Systems for Smart Grids: A Tutorial on Architectures and Applications

Evaluating Jailbreaking Vulnerabilities in LLMs Deployed as Assistants for Smart Grid Operations: A Benchmark Against NERC Standards