Utility API & AI Security: Exposing Data Without Exposing Control

TL;DR Utilities need operational and customer data in dashboards, portals, mobile apps, and AI tools. Every new integration is also a new potential path into systems that control physical infrastructure. The requirements are consistent regardless of vendor: no inbound exposure of source systems, every request bound to a real identity, least privilege down to the field, credentials never in the client, rate limits, full audit logging, and enforcement that runs on infrastructure you control.