Closing the Gap - Episode 5 of 8
What has to be true before an agent is allowed to change anything on its own.
Six weeks into the recommend-only action from the agentic system, the plant manager has stopped being surprised by the 6:10 plans, and she has started being annoyed by something else. Every morning the agent proposes the same kind of routing change, she approves it in ten seconds, and then a planner spends twenty minutes typing it into the ERP and double-checking it. So she asks the question the IT director warned everyone about, which is whether the agent could just make that change itself once she says yes.
It is a fair question, and it changes what the agent is. An agent that only recommends is a very fast advisor, and the worst it can do is waste someone's time with a bad idea. An agent that can write to the ERP, the MES, or the quality records has become part of how the plant is controlled, and a bad change there can ship the wrong part, release a held batch, or leave an auditor asking who did what. That is why we treat write access as something the plant hands over one approved action at a time, inside a boundary your people draw.
The boundary starts with what the agent is allowed to touch, and the answer is as little as possible. For the routing change, that might mean the agent can move a job between two named machines that the customer has approved for that part, during first shift, and nothing else. It cannot change a ship date, it cannot release anything on quality hold, and it never sends a command to a machine controller on the floor. The passwords it uses to reach the ERP are held outside the AI model itself, so the model never sees them and cannot leak them.
The second part of the boundary is a check that does not involve the AI at all. Before any change posts, a plain rule-checking program, the same kind of logic your ERP already uses to stop someone booking a part to a machine that does not exist, compares the proposed change with the rules your team wrote. If the job is going to a machine outside the approved list, or the fixture is booked for another order, the change is stopped and handed back to a person. The AI can be clever, but it does not get the final word on whether a change is legal under your rules.The third part is what we mean by a transactional boundary, which sounds technical but is something every plant already understands. A routing change usually means several records moving together, such as the work order, the machine schedule, and the material reservation, and either all of them change or none of them do. If the ERP accepts the work order but rejects the material move, the agent rolls the whole change back to exactly where it was, so the plant never ends up half-changed with a schedule that does not match the stockroom. Every recommendation, approval, change, and undo is written to a log with a time and a name on it, so when someone asks who moved that job at 6:22, the answer takes one search.
The last part is the one people forget, which is that the plant has to run fine without any of this. If the network drops or the AI service goes down, the planners go back to the way they worked six weeks ago, and nothing on the floor depends on the agent being available. This is in line with what the U.S. government's cybersecurity agency, CISA, tells plants about keeping production systems separated and able to run by hand, and with the NIST framework many companies already use to manage AI risk. For plants that want the AI kept entirely inside their own walls, the models can run on the plant's own servers, including on networks that are not connected to the internet.
Here is what a miss looks like with all of that in place. One morning the agent proposes moving a job to the older machine, the plant manager approves it, and the rule check passes, but the material system rejects the reservation because the bar stock was reallocated at 5:50. The agent undoes the work order change in the same second, flags it to the planner with the reason, and offers the next-best plan. Nothing was half-changed and nothing shipped wrong, and the only cost was a few minutes of the planner's attention, which is the honest kind of failure a plant can live with.
So the answer to the IT director is that the agent only ever carries out the fifth step inside rules your people wrote. A separate check enforces those rules, every change either goes in whole or comes back out cleanly, and the plant can always run without the agent. That leaves the question the planner who used to type those changes asked out loud in the break room, which is what happens to his job once the agent is doing the typing. The next episode is about the people, and about deciding where the hours the agent frees up should go before anyone counts them as savings.
Book a demo. Ramu Sunkara, our CEO, and Dr. Sudesh Kannan offer a complimentary evaluation of one workflow, in which we map where your IT and plant-floor systems meet, agree on the first change an agent could safely make, and test the rollback with your team before anyone grants write access.
If you would rather follow along first, join the mailing list and we will send each of the next three episodes as it is published.
For more information and to download the white paper, The Zenera AI Playbook White Paper, go to zenera.ai/use-cases/manufacturing/ai-playbook.