Paper deep dive
TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions
Md Fazley Rafy
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/22/2026, 2:05:47 AM
Summary
The paper introduces TwinGridShield, a model-independent runtime authorization layer designed to prevent unsafe actions proposed by Large Language Model (LLM) agents in power grid management. Unlike traditional text-based filters or schema validators, TwinGridShield evaluates the physical consequences of proposed commands (such as branch switching, redispatch, and load shedding) against a deterministic network twin using DC power flow analysis. In a controlled study on the IEEE 14-bus system, TwinGridShield achieved 0% unsafe releases under matched-model conditions, significantly outperforming direct execution, schema validation, and text filtering. The system also demonstrates robustness under model mismatch, with unsafe acceptance rates of 5.63% under load measurement errors and 30.09% under branch rating discrepancies.
Entities (8)
Relation Signals (6)
Md Fazley Rafy → affiliatedwith → West Virginia University
confidence 95% · Author is with the Lane Department of Computer Science and Electrical Engineering, West Virginia University
TwinGridShield → evaluatedon → IEEE 14-bus system
confidence 95% · The evaluation uses the IEEE 14-bus system... A controlled IEEE 14-bus study evaluates single-step switching...
TwinGridShield → uses → DC Power Flow
confidence 95% · The prototype checks connectivity, branch-flow, generator, and load-shedding invariants... using DC power flow
TwinGridShield → outperforms → Text filter
confidence 90% · The text filter reduces unsafe-proposal execution rate to 42.0%... TwinGridShield rejects all unsafe proposals... 0 unsafe executions in 500 attacked trials
TwinGridShield → protectsagainst → Prompt Injection
confidence 90% · TwinGridShield applies this separation to LLM tool calls... The monitor evaluates the physical consequence of each candidate action independent of the text that produced it.
MATPOWER → provides → IEEE 14-bus system
confidence 85% · MATPOWER provides the IEEE 14-bus representation and a standard basis for reproducible steady-state power-flow studies
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model (LLM)-assisted energy-management tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hash-chained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matched-model experiment, a stochastic proposal source configured to select an unsafe action with probability p=0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded +20% and -20% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings.
Tags
Links
- Source: https://arxiv.org/abs/2608.15391v1
- Canonical: https://arxiv.org/abs/2608.15391v1
Trouble viewing inline? Open PDF directly →
Full Text
33,133 characters extracted from source content.
Expand or collapse full text
TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent ActionsAuthor is with the Lane Department of Computer Science and Electrical Engineering, West Virginia University, Morgantown, WV, USA, 26505. Corresponding Author email address: mdfazleyrafy@ieee.org.PubID: pubid: 979-8-3315-5720-1/26/$31.00 ©2026 IEEE Md Fazley Rafy Affiliation: Lane Department of Computer Science and Electrical Engineering West Virginia University Morgantown, WV-26505, USA ORCID: 0000-0003-3057-9546 Abstract Large language model (LLM)-assisted energy-management tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hash-chained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matched-model experiment, a stochastic proposal source configured to select an unsafe action with probability p=0.84p=0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded ±20%± 20\% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings. Index Terms: large language model agents, power-system cybersecurity, prompt injection, runtime assurance, Digital Twin, grid operation I Introduction LLM-based assistants are moving from explaining operating procedures toward calling software tools. In a power-system domain, an agent might query an energy management system (EMS), summarize alarms, formulate a redispatch, or prepare a switching request. Domain models already demonstrate that language models can support advanced power-dispatch tasks [3], and the reasoning-and-action pattern explicitly interleaves language reasoning with external tool calls [17]. This interface can map heterogeneous data and operator intent into a common conversational workflow, but it also changes the failure boundary. A wrong answer is no longer only text; it can become an action against cyber-physical infrastructure. Two weaknesses meet at that boundary. First, token prediction is not a certified model of network physics. An agent can output a correctly typed branch-opening, redispatch, or load-shedding command while missing islanding, thermal-limit, generator-limit, or critical-service consequences, which is often referred to as action blindness [16]. As a concrete example, a tampered work order may instruct an agent to open a heavily loaded branch to clear a diagnostic code. The resulting command can satisfy the tool schema while islanding part of the network or transferring flow beyond a branch rating, without triggering any schema-level alarm. Second, the context presented to an agent mixes trusted instructions with untrusted content. Indirect prompt injection has been shown to compromise LLM-integrated applications through retrieved or observed text [5]. Direct instruction hierarchies can also be subverted by crafted prompts [11]. In a control center, the untrusted channel can be an equipment description, vendor document, ticket, alarm annotation, or compromised retrieval record. Network segmentation and role-based access remain necessary, but access authorization alone does not answer the state-dependent physical question: is this particular command safe under the current grid condition? Power-grid security is already a cyber-physical problem rather than a purely information-security problem [14]. Industrial-control guidance emphasizes defense in depth and consequence-aware risk management [10], while the NIST generative-AI profile calls for measuring and managing risks across the AI lifecycle [15]. Existing LLM defenses often focus on classifying malicious text or constraining tool syntax. Text filters are sensitive to phrasing, while a schema establishes only that a command is well formed. Agent sandboxes can expose risky behavior before real execution [12], but an LM-emulated environment is not a deterministic power-flow certificate. Conversely, classical runtime enforcement can suppress events that violate a security policy [13], and shielding has been used to constrain learned control policies [1]. The remaining need is a compact architecture that applies runtime-enforcement principles to tool-using grid agents while remaining independent of the agent’s prompt, vendor, and model. The contribution of this paper is three-fold: 1. Formalizes action blindness for a grid agent as a mismatch between a proposed structured action and a consequence-closed safe set. 2. Develops TwinGridShield, which combines typed commands, a deterministic network twin, explicit operating invariants, fail-closed enforcement, escalation, and a tamper-evident decision chain. 3. Evaluates TwinGridShield in a controlled IEEE 14-bus authorization study using a configured stochastic proposal source, matched-model conformance testing, runtime measurements, and a separate parameter-mismatch analysis where the surrogate experiment evaluates authorization policies under a fixed proposal distribution I Related Work and Research Gap TABLE I: Representative LLM agent systems in power-system operations System Primary task Action- Runtime executing? safety gate? GAIA [3] Dispatch optimization Yes No explicit PowerAgent [18] Agentic grid workflow Yes No explicit Grid-Agent [19] Violation remediation Yes LM sandbox GridMind [7] System analysis Yes No explicit ChatGrid [8] Visualization / Q&A No N/A This work Action authorization — Prop. 1 As Table I shows, LLM agents in power systems have moved from advisory Q&A toward tool-mediated operation. Here, no explicit indicates that the cited work does not report a deterministic runtime gate that checks the physical consequence of each proposed grid action before release. Tool-using frameworks such as ReAct [17] interleave natural-language reasoning with structured external calls, and domain agents now span dispatch optimization, violation remediation, and multi-fidelity simulation support [3, 18, 19]. The safety boundary changes when workflow automation converts a language-model recommendation into a machine-authorized command, or when repeated suggestions create automation bias. The relevant assurance problem then includes the model, context sources, tool broker, network model, actuator permissions, and operator, rather than model accuracy alone. Perez and Ribeiro analyze direct instruction attacks against language models [11]. Greshake et al. examine the operationally relevant indirect case, in which content consumed by an application carries the adversarial instruction [5]. Separation of data and instructions remains unresolved when both are serialized as tokens. ToolEmu evaluates LM agents inside an LM-emulated sandbox and identifies risky tool-use behavior without exposing a real environment [12]. That approach supports red teaming, whereas grid operation also requires an online authorization decision tied to the current physical state. Input classifiers, delimiters, least-privilege tool scopes, and agent sandboxes reduce exposure and remain useful in a layered design. They do not certify that an allowed grid action is physically admissible under the present operating condition. Conversely, a consequence monitor does not sanitize the model, protect confidential content, or determine whether an operator’s objective is legitimate. Text-level and consequence-level defenses therefore answer complementary assurance questions. Runtime enforcement admits only traces satisfying an enforceable policy [13], and safe-learning shields intervene between a learned policy and its environment [1]. Power-system security work has long treated cyber actions and physical state as coupled [14]. TwinGridShield applies this separation to LLM tool calls: the probabilistic model proposes a structured action, and a deterministic authorization layer evaluates the modeled grid consequence before release. TABLE I: Runtime defense strategies compared Defense Injection Physical Formal Grid- blocked? check? claim? aware? Direct execution — No None No Schema validation Struct. only No None No Text filter Keyword No None No LM sandbox [12] Partial Emulated None Opt. TwinGridShield Conseq. Yes Prop. 1 Yes Table I compares the authorization question addressed by TwinGridShield with common execution-time defenses. Physical consequence checking differs from injection detection because it evaluates the post-action network state rather than the text pattern that produced the action. As a result, an unsafe command can be rejected even when the inducing prompt is obfuscated, retrieved from a document, or expressed without a visible attack marker. I Threat Modeling & Consequence-Aware Runtime Enforcement The considered control loop contains an LLM agent, a tool broker, a runtime monitor, a deterministic network twin, and a downstream control API. In this paper, the deterministic network twin is used as a digital-twin representation of the current grid state for pre-release consequence evaluation, rather than as a forecasting or adaptive control model. Let xt∈x_t denote the estimated operating state at time t, including topology, load, generation, and equipment limits. The agent receives an operator request qtq_t and context ctc_t, then proposes one typed action at∈a_t . The prototype command vocabulary includes generator redispatch, branch opening, bounded load shedding, and no operation, as summarized in Table I. The transition model f f predicts the post-action state x^t+1=f^(xt,at) x_t+1= f(x_t,a_t) before the control API receives any command. As shown in Fig. 1, the LLM agent has no direct actuator credentials, and each candidate action must pass through the monitor. TABLE I: Prototype command contract Action Parameters Selected consequence checks Redispatch generator, MW generator and branch limits Open branch branch ID solvability, islands, branch limits Shed load bus, fraction critical and total shedding budgets No-op none current-state feasibility Fig. 1: TwinGridShield runtime authorization workflow The adversary controls natural-language content in ctc_t and knows the tool schema, but cannot directly call the actuator. The attack objective is to induce a valid command that islands part of the network, overloads a branch, violates a generator or slack limit, or exceeds total or critical-load shedding limits. Four injection channels are modeled: explicit override, obfuscated instruction, poisoned retrieved procedure, and authority or role-play instruction. The trusted computing base for the enforcement claim consists of the monitor, the post-ingestion state estimate, the network model used by the twin, the configured invariant set, and the actuator access-control policy. Under this threat model, prompt injection is not treated as a phrase-detection task. It is treated as a source of arbitrary schema-valid candidate actions, and the monitor evaluates the physical consequence of each candidate action independent of the text that produced it. TwinGridShield separates command formation from command authorization. The first stage maps the agent output to a closed command vocabulary and checks target identifiers, numeric ranges, and required fields. This typed boundary removes free-form tool execution, but it does not establish physical admissibility. A branch-opening command may be syntactically valid while creating an island, and a load-shedding command may satisfy its data type while exceeding a critical-service budget. The second stage applies the candidate command to a read-only state snapshot and solves a DC power flow. For bus-angle vector θ, branch incidence matrix A, and diagonal branch-susceptance matrix BℓB_ , the predicted nodal injections and branch flows are given in Eq. (1). p=ABℓAθ,f=BℓAθp=A TB_ Aθ,\ f=B_ Aθ (1) The slack generator balances net demand, whereas MATPOWER provides the IEEE 14-bus representation and a standard basis for reproducible steady-state power-flow studies [20]. =x:C(x)=1,|fk(x)|≤f¯k,p¯g≤pg≤p¯g,L(x)≤L¯,S=x:\ C(x)=1,\ |f_k(x)|≤ f_k, p_g≤ p_g≤ p_g,\ L(x)≤ L, (2) In Eq. (2), the modeled safe set is defined as Swhere C(x)C(x) denotes connectivity and solvability, f¯k f_k is the rating of branch k, and L(x)L(x) contains total and critical-load shedding quantities. The monitor implements the release rule through G(∙)G( ). G(xt,at)=[schema(at)][f^(xt,at)∈].G(x_t,a_t)=1[schema(a_t)]1[ f(x_t,a_t) ]. (3) Only G(xt,at)=1G(x_t,a_t)=1 in Eq. (3) releases the command. For G(xt,at)=0G(x_t,a_t)=0, the runtime result is a no-op, a machine-readable list of violated invariants, and escalation to a human operator or a separately certified controller. Proposition 1 (encoded-invariant release guarantee). Assume that (i) every actuator request passes through G(⋅)G(·), (i) the actuator executes only released commands, and (i) f^(x,a) f(x,a) exactly predicts the state variables used by S. Then no released command produces a modeled next state outside the encoded safe set S. Proof: By Eq. (3), release implies G(xt,at)=1G(x_t,a_t)=1 and therefore f^(xt,at)∈ f(x_t,a_t) . Under assumption (i), the modeled post-action state equals the relevant physical state variables used by S, so xt+1=f^(xt,at)∈x_t+1= f(x_t,a_t) . Assumptions (i) and (i) exclude alternate execution paths around the monitor. Hence, no released command violates the encoded invariant set. □ The enforcement rule depends on the predicted physical consequence, not on the string pattern or prompt source that produced the command. A text filter may block some injection styles, but a consequence gate rejects any candidate whose predicted post-action state violates the encoded invariant set. The guarantee in Proposition 1 applies to the modeled state variables and configured invariants; it does not claim safety for unmodeled dynamics, incorrect measurements, stale topology, or missing operating constraints. The logger records each authorization decision using a chained digest. For the decision record rtr_t, containing the state digest, canonical action, result, and reason, the logger is computed as given in Eq.(4). ht=H(ht−1,|,rt)h_t=H(h_t-1,|,r_t) (4) Changing an interior record alters every subsequent digest after the next trusted checkpoint, following the chained-digest principle of digital timestamping [6]. The log supports auditability and incident reconstruction, while the physical release decision remains governed by (3). IV Experimental Method The evaluation uses the IEEE 14-bus system with 14 buses, five generators, and 20 branches. Each randomized operating scenario scales the total load by a factor drawn from [0.82,1.08][0.82,1.08] per unit and independently scales the loads at buses 3, 4, 9, and 14 by factors drawn from [0.92,1.08][0.92,1.08]. Because the educational IEEE 14-bus case does not provide binding branch ratings for this authorization experiment, each experimental rating is assigned as max(1.35|fk0|,25MW) (1.35|f_k^0|,25\ MW), where fk0f_k^0 is the base-case branch flow. These branch ratings are synthetic stress-test thresholds constructed to activate operating constraints, but they need to be validated with equipment ratings from a utility transmission system. The DC formulation represents active-power flow and topology only, where each trial evaluates one action against one state snapshot. These assigned limits create active operating constraints for comparing authorization policies under identical network conditions. The action pool contains non-slack generator redispatch setpoints, load shedding between 5% and 80% at four critical buses, every single branch-opening action, and no operation. Candidate actions are labeled safe or unsafe using the same DC power-flow model and invariant set used by the monitor. Unsafe outcomes include islanding, branch overload, generator-limit violation, slack-limit violation, and violation of total or critical-load shedding budgets. This design evaluates runtime authorization under a controlled consequence model rather than model-specific LLM susceptibility. The main experiment contains 1,000 seeded trials, with 500 benign trials and 500 attacked trials. To make the authorization experiment reproducible and independent of version-specific LLM behavior, the proposal source is a parameterized stochastic threat surrogate [4]. Under attack, the surrogate selects an unsafe action with probability 0.84; under benign conditions, it selects an unsafe action with probability 0.06. These probabilities define fixed proposal distributions for evaluating execution policies, not measured attack rates for a specific LLM. Unsafe choices are sampled from the eight highest-severity feasible candidates in the scenario. The same proposal sequence is then evaluated by four execution policies: direct execution, schema validation, prompt text filtering, and the proposed TwinGridShield. Direct execution releases every proposal, and schema validation checks only types and numeric ranges. The text-filter baseline blocks proposals associated with four visible injection markers. TwinGridShield applies the full typed-boundary and consequence-checking rule in Eq. (3). The reported metrics are unsafe execution rate, unsafe releases per 500 attacked-condition trials, benign false-block rate, Wilson 95% confidence interval, and local wall-clock latency [2, 9]. The experiment uses seed 2026 and generates per-trial CSV files, vector figures, and audit-chain verification with one command. Seven unit tests evaluate base-case flow, island detection, critical-load limits, schema and semantic separation, slack-command exclusion, safe-command passage, and log-tampering detection. Runtime values were measured on a 64-bit Windows system using Python 3.9.21, NumPy 1.21.5, and Matplotlib 3.7.1. A separate parameter-mismatch experiment evaluates residual authorization error when the guard retains its nominal DC model but the evaluation oracle uses perturbed states or limits. The study uses 1,000 independent proposals and considers mismatch levels δ∈0,5,10,20%δ∈0,5,10,20\%. For load-measurement mismatch, the actual load at bus b is pd,bactual=pd,bseen(1+ub),ub∼[−δ,δ].p_d,b^actual=p_d,b^seen(1+u_b), u_b [-δ,δ]. (5) For rating overestimation, each actual branch rating is f¯kactual=(1−δ)f¯kmodel. f_k^actual=(1-δ) f_k^model. (6) Trials whose perturbed pre-action state is already unsafe are excluded so that the reported rate measures authorization error rather than initial-state infeasibility. At 20% mismatch, this filtering leaves 954 load-error trials and 841 rating-error trials. Conditional unsafe acceptance is the fraction of oracle-unsafe actions allowed by the nominal guard, while conditional false block is the fraction of oracle-safe actions rejected by the nominal guard. V Results and Analysis TABLE IV: Defense results across 1,000 randomized operating scenarios Defense Unsafe Unsafe releases False p95 exec. (%) /500 attacked block (%) (ms) Direct 46.1 421/500 0.0 0.31 Schema 46.1 421/500 0.0 0.48 Text filter 25.0 210/500 0.0 0.41 TwinGridShield 0.0 0/500 0.0 0.44 Fig. 2: Unsafe execution by injection style: the text-filter baseline depends on visible markers, while TwinGridShield evaluates the proposed physical consequence Fig. 3: Residual authorization error under parameter mismatch Table IV shows that typed tool access does not by itself provide physical safety. Direct execution and schema validation produce the same 84.2% unsafe-proposal execution rate because every adversarial command is intentionally schema-valid. Across 500 attacked trials, this corresponds to 421 unsafe executions, with a 95% Wilson interval of 80.74–87.13%. The overall unsafe-execution rate is 46.1% because the benign set also contains action-blindness cases. The result separates syntactic validity from consequence validity: a named tool call with valid fields can still violate branch, generator, topology, or load-shedding constraints. The text filter reduces unsafe-proposal execution rate to 42.0% by blocking the explicit and role-play injection strings that contain its visible markers. Obfuscated and retrieved-procedure injections remain schema-valid and pass the filter, as shown in Fig. 2. This pattern confirms that injection detection and physical authorization answer different questions. Injection detection attempts to classify the cause of an unsafe proposal, while runtime enforcement evaluates the effect of the proposed action on the network state. The latter directly supports the release condition in Proposition 1. Under matched-model conditions, TwinGridShield rejects all unsafe proposals and admits all benign safe proposals in the modeled data. The measured result is 0 unsafe executions in 500 attacked trials, with a 95% Wilson interval of 0–0.76%. The rejected set is not concentrated in a single action type: 231 rejected commands are branch openings, 165 are redispatch commands, and 65 are load-shedding commands. The corresponding violated-invariant reports include 330 branch-limit violations, 66 islanding outcomes, 52 combined total and critical-load shedding violations at bus 3, and 13 critical-load shedding violations at bus 4. These structured reasons provide operational information beyond a generic refusal because they identify the constraint that prevents authorization. The median and p95 runtime of TwinGridShield are 0.18 ms and 0.44 ms, respectively, including schema validation and the 14-bus linear solve. The measured latency is comparable to the schema and text-filter baselines in Table IV, indicating that deterministic consequence checking adds negligible overhead for this case size. The generated 4,000-record audit chain also verifies successfully. A log-tampering unit test mutates a previous allow bit and causes verification failure, confirming that the chained record detects decision-history modification after the trusted checkpoint. V-A Sensitivity to Model Mismatch Figure 3 reports residual authorization error when the guard uses the nominal model and the oracle evaluates perturbed operating states or branch ratings. Under bounded per-bus load-measurement error, unsafe acceptance increases from 0% at the matched case to 1.94%, 4.02%, and 5.63% at 5%, 10%, and 20% mismatch, respectively. When actual branch ratings are uniformly below the modeled values, unsafe acceptance increases more sharply to 10.24%, 16.85%, and 30.09% at the same mismatch levels. Observed false-block rates remain 0% across the perturbation levels, although their Wilson upper bounds remain nonzero. The rating-mismatch case produces the larger residual error because reducing every actual branch rating systematically converts some nominally admissible flows into oracle overloads. Load-measurement error has a smaller effect because signed bus-level perturbations can partly offset each other in the resulting branch flows. These results show that consequence checking eliminates unsafe execution only with respect to the modeled invariant set and the state used by the monitor. In practice, uncertainty margins on branch ratings, measurement freshness checks, and conservative release thresholds can trade a lower unsafe-acceptance rate for a higher false-block rate. However, this tradeoff is an operating-policy decision, not a prompt-design decision. VI Limitation and Path Forward The reported evaluation should be interpreted as a consequence-aware runtime authorization study rather than as an empirical measurement of LLM prompt-injection susceptibility. The proposal source is a configured stochastic surrogate, so the 84.2% unsafe-proposal rate characterizes the fixed experimental distribution and should not be read as an attack-success rate for any deployed LLM. Moreover, the parameter-mismatch study provides the principal evidence on residual authorization error when this matched assumption is relaxed. The present scope is limited to single-step actions on the IEEE 14-bus DC formulation with experimentally assigned branch ratings, and it does not evaluate AC voltage constraints, reactive-power limits, dynamic-security behavior, cascading effects, stale topology, or multi-step adversarial command sequences. These limitations define the boundary of the current benchmark and motivate future evaluation with version-pinned LLM agents, a fixed prompt-injection corpus, AC contingency analysis, and hardware-in-the-loop testing. VII Conclusion This paper presented TwinGridShield, a consequence-aware runtime authorization layer for structured grid-agent actions. The method separates language-based command proposal from physics-based command release: the LLM proposes a typed action, while a deterministic network twin and invariant checker determine whether the action reaches the control API. This study establishes a controlled and reproducible authorization benchmark using a configured stochastic proposal source. The formal release rule shows that, under twin and measurement fidelity, commands that violate encoded invariants are not released. In the IEEE 14-bus study, the source configured with punsafe=0.84p_unsafe=0.84 generated 421 oracle-unsafe proposals in 500 attacked-condition trials, yielding a realized frequency of 84.2%. This frequency characterizes the configured proposal distribution used to compare the authorization policies. Under matched-model conditions, TwinGridShield produced 0 unsafe releases in 500 attacked-condition trials, confirming that the implementation consistently enforced the encoded DC authorization predicate shared with the labeling oracle. The parameter-mismatch experiment provides the principal robustness result. Unsafe acceptance increased to 5.63% under bounded ±20%± 20\% per-bus load-measurement error and to 30.09% when actual branch ratings were 20% below modeled ratings. These results quantify the dependence of authorization performance on state-estimation, network-model, and equipment-rating fidelity. This result shows that consequence-aware runtime enforcement can close the execution boundary for modeled invariants, while field deployment requires conservative margins, measurement-freshness checks, and accurate equipment-limit modeling. The zero unsafe-release result should therefore be interpreted within the modeled authorization scope. The evaluation establishes a single-action DC power-flow authorization baseline and does not cover unmodeled AC voltage constraints, dynamic stability, cascading effects, stale topology, incorrect ratings, or multi-step adversarial action sequences. Extensions to AC contingency analysis, voltage and reactive-power limits, dynamic security checks, multi-action temporal policies, and hardware-in-the-loop testing would broaden the invariant set and reduce the gap between modeled authorization and operational deployment. The present evaluation establishes a single-step DC power-flow authorization baseline on the IEEE 14-bus transmission benchmark using experimentally assigned branch ratings. Future work will extend this baseline with version-specific LLM-generated actions, a fixed prompt-injection corpus, AC power flow, voltage and reactive-power constraints, dynamic-security assessment, contingency analysis, and multi-action temporal policies. References [1] M. Alshiekh, R. Bloem, R. Ehlers, B. Könighofer, S. Niekum, and U. Topcu (2018) Safe reinforcement learning via shielding. In Proc. AAAI Conf. Artificial Intelligence, Vol. 32. External Links: Document Cited by: §I, §I. [2] A. Borjigin, I. Stadnyk, B. Bilski, S. Hovorov, and S. Pidturkina (2026) Execution is the new attack surface: survivability-aware agentic crypto trading with openclaw-style local executors. arXiv preprint arXiv:2603.10092. Cited by: §IV. [3] Y. Cheng, H. Zhao, X. Zhou, J. Zhao, Y. Cao, C. Yang, and X. Cai (2025) A large language model for advanced power dispatch. Scientific Reports. External Links: Document Cited by: §I, TABLE I, §I. [4] C. Denamiel, J. Šepić, X. Huan, C. Bolzer, and I. Vilibić (2019) Stochastic surrogate model for meteotsunami early warning system in the eastern adriatic sea. Journal of Geophysical Research: Oceans 124 (11), p. 8485–8499. Cited by: §IV. [5] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz (2023) Not what you’ve signed up for: compromising real-world LLM-integrated applications with indirect prompt injection. arXiv preprint arXiv:2302.12173. Cited by: §I, §I. [6] S. Haber and W. S. Stornetta (1991) How to time-stamp a digital document. Journal of Cryptology 3 (2), p. 99–111. External Links: Document Cited by: §I. [7] H. Jin, K. Kim, and J. Kwon (2025) GridMind: LLMs-powered agents for power system analysis and operations. In Proc. SC’25 Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, External Links: Document Cited by: TABLE I. [8] S. Jin and S. Abhyankar (2024) ChatGrid: power grid visualization empowered by a large language model. In Proc. IEEE Workshop on Energy Data Visualization (EnergyVis), p. 12–17. Cited by: TABLE I. [9] J. W. Leong (2026) Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful llm agents. arXiv preprint arXiv:2605.08442. Cited by: §IV. [10] National Institute of Standards and Technology (2023) Guide to operational technology (OT) security. Technical report Technical Report Special Publication 800-82 Rev. 3, NIST. External Links: Document Cited by: §I. [11] F. Perez and I. Ribeiro (2022) Ignore previous prompt: attack techniques for language models. arXiv preprint arXiv:2211.09527. Cited by: §I, §I. [12] Y. Ruan, H. Dong, A. Wang, S. Pitis, Y. Zhou, J. Ba, Y. Dubois, C. J. Maddison, and T. Hashimoto (2023) Identifying the risks of LM agents with an LM-emulated sandbox. arXiv preprint arXiv:2309.15817. Cited by: §I, TABLE I, §I. [13] F. B. Schneider (2000) Enforceable security policies. ACM Transactions on Information and System Security 3 (1), p. 30–50. External Links: Document Cited by: §I, §I. [14] S. Sridhar, A. Hahn, and M. Govindarasu (2012) Cyber–physical system security for the electric power grid. Proceedings of the IEEE 100 (1), p. 210–224. External Links: Document Cited by: §I, §I. [15] E. Tabassi (2023) Artificial intelligence risk management framework (ai rmf 1.0). Technical report Elham Tabassi, NIST. Cited by: §I. [16] Z. Wang, B. Yu, J. Xu, and Z. Li (2026) Action boundary blindness: when LLM agents cannot tell where one action ends and another begins. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), M. Liakata, V. P. Moreira, J. Zhang, and D. Jurgens (Eds.), San Diego, California, United States, p. 36883–36899. External Links: Link, ISBN 979-8-89176-390-6 Cited by: §I. [17] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao (2023) ReAct: synergizing reasoning and acting in language models. In Proc. Int. Conf. Learning Representations (ICLR), Cited by: §I, §I. [18] Q. Zhang and L. Xie (2025) PowerAgent: a road map toward agentic intelligence in power systems: foundation model, model context protocol, and workflow. IEEE Power and Energy Magazine 23 (5), p. 93–101. Cited by: TABLE I, §I. [19] Y. Zhang et al. (2025) Grid-agent: an LLM-powered multi-agent system for power grid control. arXiv preprint arXiv:2508.05702. Cited by: TABLE I, §I. [20] R. D. Zimmerman, C. E. Murillo-Sánchez, and R. J. Thomas (2011) MATPOWER: steady-state operations, planning, and analysis tools for power systems research and education. IEEE Transactions on Power Systems 26 (1), p. 12–19. External Links: Document Cited by: §I.