AI Safety in Industrial Automation: Governing Agents the Way You Govern Operators

When agents start taking actions on plant equipment, the consequence stops being financial. A wrong order loses money. A wrong setpoint, a wrong isolation, or a wrong instruction to a controller can hurt people.

Industrial cybersecurity has a mature framework for this kind of risk. The interesting question is whether it covers agents — and the answer is more useful than a simple no.

The gap everyone points to

IEC 62443, the standard family for industrial automation and control system security, was written around components whose behaviour can be specified. A PLC does the same thing given the same inputs. That's what makes it certifiable: you can describe its behaviour, test it, and hold it to that description.

An AI agent isn't like that. Given the same inputs it may not produce the same output, and its reasoning can't be fully specified in advance. So the usual conclusion is that 62443 has no provision for agents, and that industrial AI is waiting on standards that don't exist yet.

That conclusion is half right. The half that's wrong is the useful part.

The standard already governs a non-deterministic actor

Every industrial control loop already contains a component that isn't deterministic: the human operator.

Operators make judgment calls. Two operators facing the same alarm may respond differently. Nobody has ever certified an operator's reasoning, and the standards don't try. Instead, the discipline governs operators in a specific way:

• It bounds what they're permitted to do — roles, permissions, zones.
• It requires approval for consequential actions — permits to work, sign-offs, two-person rules.
• It puts interlocks on the dangerous ones, which act regardless of what the operator intends.
• It makes every action reconstructable afterwards, for incident review.

None of that makes the operator predictable. It makes the permitted action boundary and the record predictable. That's the right model for an agent too.

The question isn't "how do we make the agent deterministic?" It's "how do we bound and record a non-deterministic actor in the loop?" — a question this industry already knows how to answer.

What that looks like for an agent

Translating the operator model gives four requirements.

A permitted action boundary. What this agent may read, what it may write, and to which systems — maintenance management, historian, engineering tools, controllers. Defined explicitly, not inherited from whatever credentials it happened to be given.

Judgment against the operating context, before execution. Not a filter on the text the agent produces, but an evaluation of the action in context. An agent's output can be plausible word for word while contradicting the physical state of the plant.

An independent stop. Held outside the agent, the way a safety instrumented system is held outside the control system. And scoped: isolating one misbehaving agent must not mean stopping the plant.

A reconstructable record. What the agent attempted, what it knew, what was allowed or blocked, under which rule, and what a human did next — the agent equivalent of the incident log.

Judging in context, not filtering text

Here's the kind of failure that makes context matter.

In a live evaluation with the cybersecurity products leadership of a Fortune Global 500 industrial company, a scenario was built around a boiler running at high temperature near an occupied building. An agent, asked about the boiler's status, reported that its controlling PLC was disconnected.

Every word in that output is plausible, and a text filter has nothing to object to. But disconnecting the controller of a live boiler is a safety-critical contradiction — the output conflicts with the physical operating context. A judge reasoning about the action against that context identified the contradiction from the two-word output.

That's the difference between scoring text and judging an action. In industrial settings, it's the whole difference.

Why deployment location decides this

Operational technology networks are segmented by design, and many are air-gapped. Zone and conduit architectures exist precisely to control what crosses between networks.

So a cloud-hosted judge isn't a procurement objection in this setting — it's architecturally disqualified. Sending plant state, agent actions and operational data to a third party to be evaluated breaches the very segmentation the security model depends on.

The judge has to run inside the zone, on hardware that's already there, with nothing leaving. That rules out most of the AI governance market before any other criterion is applied.

Scoping an edge pilot

If you're evaluating agentic AI for plant operations, six questions define a pilot that's safe to run:

1. Which workflow? Start with the agent closest to production, not the most ambitious one.
2. What can it read and write? Map every system it touches.
3. What needs human approval today? That's your existing boundary — start there.
4. What near-miss would make this urgent? Name the failure you're actually worried about.
5. Who owns the technical evaluation? One named person.
6. Which non-safety-critical environment can host a shadow test? Observe and judge, block nothing, measure.

A shadow deployment — where the judge evaluates every action but enforces nothing — tells you what it would have caught and what it would have wrongly flagged, before it's anywhere near a safety function.

Where we stand

Syntrox is built on this operator model: an independent judge that evaluates each agent action against the operating context and your own procedures before it executes, names the rule it applied, and holds an isolation path outside the agent. It runs on edge hardware inside the zone, with no data egress.

The boundary: judgment, blocking, escalation and isolation are live. Automatic isolation currently triggers on spend and cost ceilings; isolation for other conditions is operator-triggered. Correction and steering are not built, and we don't claim IEC 62443 certification — no one can certify an agent's reasoning, which is exactly why the operator model is the right one.

The industry doesn't need to wait for a new standard to govern agents. It needs to apply the one it already uses for people.