Line of business and OT

Target state

In short: Agents here inform the operator and never touch the controls; every suggestion is checked in simulation first and a person decides.

This is the layerLayer (the fourteen layers). One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14). where agents meet physics. Agents sit on the information path, never the control path. They watch alarm and event streams with context the operator cannot hold in working memory. They reconcile asset data across systems that disagree. They retrieveRetrieval. Finding the few relevant pieces of company information for a task and placing them in front of the model. matched history for the crew in front of the work. Everything that reaches an operator passes a validation loopValidation loop. Checking an agent's proposal against rules or a simulation before a person sees it, so only options that pass are shown.: candidate actions are simulated against a digital twinDigital twin. A simulation of a real asset or process, used to test a proposed action before it reaches the real thing. (a simulation of the real asset) or a rule set. The raw modelModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do. response is never displayed. Only filtered options appear, and the operator decides. Agent output lives in the alert channel, visually distinct from configured alarms, and is never credited as a protection layer. Asset data quality runs as a governed flywheelLearning flywheel. The controlled loop that makes agents better over time: collect evidence, test, approve, roll out in stages, and pull back what fails., a controlled improvement loop, with a human-gated write path to the register. Sanitized operational technology (OT)OT (operational technology). The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop. data flows outbound to separate secured artificial intelligence (AI) systems. Segmentation is preserved, and revert-to-manual is documented and tested. Control authority stays with humans and deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. systems, which follow fixed rules and give the same answer every time. Any exception is a separately engineered decision with its own safety case.

layer · architecture

The validation loop: information path, never control path

Raw model output is never displayed: candidates are validated against a digital twin or rules, filtered, and shown in the alert channel; the operator decides.

1. 01System

   System

   Alarm and event stream

2. 02Agent

   Agent

   Agent

   Assembles context, proposes candidates

3. 03Control

   Control

   Digital twin / rules

   Simulate and filter candidates

4. 04Evidence

   Evidence

   Alert channel

   EEMUA alert, distinct from configured alarms

5. 05Human

   Human

   Operator

   Holds all decision authority; tested revert-to-manual

6. 06Boundary

   Boundary

   Safety instrumented system

   Untouched; ML excluded by IEC 61511

Unidirectional or brokered read paths by consequence class; agent output is never an independent protection layer.

Diagram description: Control-room validation loop from alarm stream through agent proposal, digital-twin validation, filtering, alert-channel display, and operator decision, with the safety system separate. The map contains Alarm and event stream; Agent: Assembles context, proposes candidates; Digital twin / rules: Simulate and filter candidates; Alert channel: EEMUA alert, distinct from configured alarms; Operator: Holds all decision authority; tested revert-to-manual; Safety instrumented system: Untouched; ML excluded by IEC 61511. Its connections are stream to agent; agent to twin for raw output never displayed; twin to alert for surviving options only; alert to operator. Important boundary: Unidirectional or brokered read paths by consequence class; agent output is never an independent protection layer.

Reviewed 2026-08-20·Sources:r05-lob-and-ot findings

Mechanisms

The validation loop

In short: The agent's raw answer is never shown; a simulation filters the options first and the operator picks from what survives.

The most important architectural idea in the published work is a negative decision: the raw large language model (LLM) response is never displayed. The National Renewable Energy Laboratory (NREL) published eGridGPT, a control-room reference architecture (NREL/TP-5D00-87440, May 2024). Staff of the California Independent System Operator (CAISO) and the Electric Reliability Council of Texas (ERCOT) reviewed it. It runs candidate actions through a digital-twin simulation it calls RTAG, filters out unsafe candidates, and displays only the surviving options. The operator decides. The model proposes options; the physics simulation decides which ones survive. Build this loop before building the suggestion, because the suggestion half already ships. Honeywell's Alarm Guidance, developed with Chevron, shipped on 1 October 2024. The Experion Operations Assistant pilot at TotalEnergies Port Arthur (November 2025) gave operators 12 minutes of notice on pressure disturbances [vendor]. Evidence: a national-lab technical report plus dated vendor releases.

The OT boundary: four principles

In short: Nine national cyber agencies say plant AI must sit outside the control loop, stay segregated, and be easy to switch off.

Nine cyber agencies published "Principles for the Secure Integration of AI in Operational Technology" on 3 December 2025, and it explicitly covers AI agents. From the United States: the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency's Artificial Intelligence Security Center (NSA AISC), and the Federal Bureau of Investigation (FBI). From elsewhere: the Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC), the Canadian Centre for Cyber Security (CCCS), Germany's Federal Office for Information Security (BSI), and the National Cyber Security Centres (NCSCs) of the UK, the Netherlands, and New Zealand. It sets four principles. Maintain the ability to revert to manual or deterministic control. Prefer push-based or unidirectional architectures (data flows one way, out of the plant) that preserve OT segmentation. Send sanitized OT data outbound to separate secured AI systems rather than embedding models in safety-critical loops. Require software bills of materials (SBOMs) for AI components and the ability to disable AI features. The stance sentence is that AI should augment, not autonomously control, safety-critical actions. Ofgem, the UK energy regulator, adds the cyber-physical warning in its Ethical AI guidance v2 (13 May 2026). Clause 6.12 names inappropriate shutdowns with cascading effect. Clause 6.13 recommends functional-safety-style wraparound guardrails and operator training to spot maloperation. Evidence: the joint publication date and clause numbers above. Verbatim wording of the joint guidance is pending re-verification (see Evidence and limits).

Standards positioning: no AI part, full existing scope

In short: No grid or industrial standard mentions AI yet, but the existing rules still bind any agent touching regulated systems.

IEC 62443, the International Electrotechnical Commission's industrial security series, has no AI part. The working posture is zones and conduits, with the agent as a new actor class. NERC CIP has no AI standard (NERC is the North American Electric Reliability Corporation; CIP is its Critical Infrastructure Protection standard set). CIP-015-1, internal network security monitoring, was approved by the Federal Energy Regulatory Commission (FERC) on 26 June 2025. It took effect on 2 September 2025, and compliance is required by 1 October 2028. It prescribes no AI requirements. The binding machinery is the existing CIP-004/005/007/010/011/013 set, and it captures agents by scope, not by name. A compliance agent that touches Bulk Electric System (BES) Cyber System Information becomes CIP-011 in scope itself. Its model and configuration become a CIP-010 change-managed baseline. Inside the Electronic Security Perimeter (ESP), the CIP-005 and CIP-007 requirements apply. That scope capture is one reason the published control-room work runs open-weight models locally, with no public network access. Evidence: standard approval and compliance dates; the NREL deployment posture.

The alert channel

In short: Agent output belongs in the low-priority alert channel, clearly separate from real alarms, and it never counts as a safety protection.

EEMUA 191 Edition 4 (November 2024), the Engineering Equipment and Materials Users Association's alarm-management guide, formalizes an alarm/alert/prompt taxonomy. An alert is information the operator "does not need to respond to, but can if they are able". That channel, visually distinct from configured alarms, is the legitimate home for agent output. There are two reasons agent output can never be credited as an independent protection layer. First, the Highly Managed Alarm category (aligned with IEC 62682:2022) requires a defined proof-test method and frequency. A probabilisticProbabilistic. Produces a best guess that can vary from run to run. AI models are probabilistic, which is why their output informs decisions rather than making them in the four zones. output, one that can vary from run to run, cannot satisfy that. Second, alarms sit in administrative controls in the risk hierarchy, and adding an agent does not change that position. The channel must respect load targets. In steady state, at most 1 alarm per operator per 10 minutes (about 150 per day). In a major upset, at most 10 in the first 10 minutes. Edition 4 contains no AI content, and the International Society of Automation (ISA) has only floated AI for a future ISA-18.2 revision. So agent output is neither blessed nor barred; the taxonomy is simply the fit. The consequence anchor is BP-Husky Toledo, 20 September 2022: 3,712 alarms in 12 hours. Two fatalities and roughly $597M in damage followed (CSB, the US Chemical Safety Board, final report June 2024).

Two human-factors failure modes

In short: Good advice makes people check less, and one confident answer can narrow what a crew notices; both need watching.

Automation bias: decision support at or above roughly 85 percent accuracy reduces operator verification behavior by 40 to 60 percent (decision-support literature). So acceptance rate is a double-edged metric, and verification rate must be watched beside it. NERC (November 2024) states the operator should have final input on actions generated by AI or machine learning (ML). It also warns against building on a mindset that treats humans as hazards. Ofgem Ethical AI v2 (13 May 2026) was updated explicitly for agentic systems. Clause 4.16 requires human oversight designed in from the earliest stage, considering both overconfidence and lack of trust. Clause 4.12 requires failure-mode analysis to cover loss of skill base and overreporting of positive outcomes. Ofgem does not mandate a human in the loop; its regime is outcomes-based and proportionate. So the human-authority line here is engineering policy, not regulatory prohibition. Aperture narrowing: operators integrate shift handover, sounds, vibrations, smells, and site conditions. A retrieval agent that presents one confident matched history crowds that out, and it can anchor a crew on the last accident. Evidence: the verification-reduction figure and the regulator clause numbers above.

The bounded closed-loop counterexample

In short: One narrow type of AI does run plant controls, but it is not a language model and it earned that place separately.

The line "control always stays human" is a policy position, not an industry fact. Yokogawa's FKDPP reinforcement-learning agent holds direct closed-loop control at two named plants. At ENEOS Materials, an 840-hour trial in January to February 2022 led to permanent adoption in March 2023. The result was a 40 percent reduction in steam and carbon dioxide (CO2) [vendor]. At the Aramco Fadhili gas plant acid gas removal unit, phased commissioning ran from October 2024 to April 2025 and was announced in October 2025. The result was a 10 to 15 percent reduction in amine and steam [vendor]. What earned that authority: bounded reinforcement learning (RL) with a small action space on a well-understood unit operation. It was trained against a high-fidelity simulator and never the live plant, formally evaluated before commissioning, and phased in. It runs on the regulatory control layer, with the independent safety instrumented system (SIS)Safety instrumented system (SIS). Certified equipment that shuts a process down safely when limits are crossed. Standards exclude AI from it., the certified equipment that shuts the process down safely, left untouched. It is not an LLM. The precise position this guide takes is the authors' position, consistent with the joint guidance. Control authority stays human for LLM-based agents. Closed-loop AI control is a separate engineering discipline with its own safety case.

The measured economic result

In short: The one measured win here is a data task: weeks of specialist work done in under a minute, still checked by the specialist.

One measured result exists in the published record, and it is a data task. NREL's eGridGPT converted energy management system (EMS) node-breaker models to bus-branch planning models in under a minute, against multiple weeks of regional-entity staff time. The converted case matched the actual EMS state-estimation case closely enough to satisfy NERC MOD-033 (model validation). NERC's stated direction is that AI may go beyond identifying anomalies to recommending or correcting models. That is the economics of this layer: weeks of specialist time collapsing to minutes, with the specialist still checking. The value is counted in avoided truck rolls, deferred replacement, and engineering hours rather than tokensToken. The unit AI usage is measured and billed in, roughly three-quarters of a word., the unit AI usage is billed in. Standards hooks for the flywheel: ISO 55013:2024 (data as an asset, from the International Organization for Standardization) with ISO 55001:2024 clause 7.6. The data constraint drives collectives. The Electric Power Research Institute (EPRI) puts roughly 95 percent of utility data behind cybersecurity and customer-privacy walls, hence its Open Power AI Consortium (March 2025). FoSMo is another: National Grid and Keen AI with the network operators SPEN, SSEN-T, UKPN, and ENWL. Ofgem's Strategic Innovation Fund (SIF) Alpha awarded it GBP 355,985 in June 2026. Its claimed GBP 22.6M five-year benefit from 2027 is projected and unrealized [vendor].

Design decisions

• Where the control point lives (CD-18, the decision on whether agents read plant data through a broker or connect to OT directly). The choice is between a mediated read (through a historian, the plant's time-series data archive, or a unified namespace) and direct OT integration. That is really a control-point question, and consequence class decides it. Enforcement sits outside the model. Agent behavior is the output of a model that its inputs can manipulate, so behavior is the wrong foundation for an OT security control (Zentera, July 2026 [vendor]). If any output can reach or influence a control action: use a unidirectional architecture plus a documented, tested path back to manual or deterministic control. If output is confined to alerts, recommendations, and data-quality findings, a brokered read path is defensible. It needs per-agent identityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked., least privilegeLeast privilege. Giving an agent only the access its current task needs, and taking it back when the task ends. (only the access the task needs), inline inspection, operator-custodied logging, and a tested kill switchKill switch. A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it.. Transport choice (historian, unified namespace, OPC UA gateway) is downstream of that question.
• Pattern A, supervisory control and data acquisition (SCADA) alert intelligence: supported, with two corrections. The suggestion half already ships, so the validation loop is the part worth designing. And the human-control line holds for LLM-based agents specifically.
• Pattern B, compliance verification agent: demoted to a design proposal with no published precedent. Sector adoption is 2 percent, there is no named utility customer in the compliance-automation market, and the industry conversation runs toward auditing the AI. The agent also becomes CIP-scoped itself.
• Pattern C, contextual safety coach: kept as a design pattern with no published production precedent. The nearest work (BuildSafe, June 2026, best BERTScore F1 0.7747) is a benchmarkBenchmark. A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements. study whose authors decline outcome claims. The automation-bias and aperture cautions apply with force.
• Pattern D, asset data quality flywheel: kept, the strongest of the four and the only one with a measured result. The write-back gate, not the reconciliation, is the architectural decision, because asset master changes propagate into rate base (the regulated asset valuation), ISO 55001 conformity evidence, and regulatory reporting. The capture half is an operating-model and incentive change, not an AI capability.

Cross-cutting concerns

Evidence and limits

The incident record at this layer is a process-safety case, not a CVE (a catalogued software vulnerability). It is BP-Husky Toledo, 20 September 2022, with the CSB final report of June 2024 identifying the alarm flood as a contributing factor. Adoption figures are survey-based (NERC, November 2024, 47 respondents), scored out of 5: switching-order generation 1.08 (lowest of 17 use cases), log entries 1.35, compliance reports 1.41, equipment-failure prediction 1.76. In the same survey, 30 percent had active bans on public AI tools, 88 percent rejected the job-loss fear, and 72 percent saw open legal and ethical questions. Vendor-published and flagged above: the 12-minute disturbance notice, both FKDPP reduction figures, the FoSMo benefit claim, and the Zentera control-point argument. The joint OT guidance wording is carried from secondary coverage, because the primary page returned access errors at retrieval. Treat the exact phrasing as unverified pending the source PDF. The human-authority line for LLM-based agents is the authors' position, not a regulatory requirement. Ofgem does not mandate a human in the loop. No FERC guidance on AI agents in utility operations exists; FERC's 2025-26 AI activity treats AI as electricity demand, or load.

Refusals (claims this page declines to use): circulating figures for an autonomous Ford manufacturing execution system (MES) deployment trace to content farms and are excluded. Equinor's reported $130M 2025 AI saving is traditional machine learning on roughly 700 rotating machines, not agents, and is excluded as agent evidence. Siemens Industrial Copilot generates IEC 61131-3 code in TIA Portal, but it does not deploy autonomously and no human-approval protocol is published. No published production alarm-triage deployment exists in an electric utility control room, and no agent holds autonomous control authority at any named water utility. AMLAS (Assurance of Machine Learning for use in Autonomous Systems) is the assurance methodology Ofgem points to. Ofgem cites it alongside ISO/IEC 23894, ISO/IEC 42001, and the NIST AI Risk Management Framework (AI RMF). AMLAS was built for conventional machine learning, not LLMs. Re-verify: the joint-guidance primary text, ISA-18.2 revision status, and CIP-015-1 compliance milestones (October 2028). Also re-verify the independent review by the Department for Energy Security and Net Zero (DESNZ), with its final report due Summer 2026.

The research behind this page

• Line of business and OT findings
• Research brief
• Vendor landscape
• Sources