What it is
AI Routing & Agents is the top of the stack, the layer that detects, decides, and acts. Its two halves divide the work cleanly. The router is the dispatcher: it weighs every incoming task and orchestrates it across lightweight, domain-specific, and general-purpose models, matching each job to the cheapest model sufficient for it. The agents are the workers: autonomous software for quality, maintenance, and supply chain that uses Common Data Model context to detect anomalies, reason about causes, recommend actions, and write every result back to the Feedback Data Layer.
The positioning matters more than the components. This layer is the most visible part of the architecture and the least self-sufficient: it is a consumer of everything below it, and deliberately so. Its perception is the namespace and the data layer; its vocabulary is the shared language; its memory is the feedback loop; its hands are the transaction systems it acts through. Intelligence in UMDA is not a bolt-on that arrives after the data work; it is the return on it.
What breaks without it
The failure mode here is subtler than the other layers', because AI arrives anyway. Without a routing and agent layer, the plant still gets models and copilots; it gets them as bolt-ons, one per project, each with its own plumbing, and the costs arrive in four familiar shapes.
First, the economics of one model for everything. Without a router, every task, from summarizing a shift report to explaining a deviation, goes to whatever flagship model the platform team standardized on, and the bill scales with usage rather than with difficulty. The plant pays deep-reasoning prices for classification work a small local model would do in milliseconds, and the latency-critical tasks wait on cloud round trips they never needed.
Second, the ungrounded agent. An agent fed by ad hoc extracts reasons over a picture nobody verified, with perfect confidence, and no amount of model quality repairs a wrong picture. Third, governance by prompt: instructions in a system prompt standing in for actual permissions, filtering, and audit, which holds exactly until it matters. And fourth, the demo that never joins the workflow: recommendations delivered to a chat window instead of into the QMS and the CMMS, where a person would have to retype them for anything to happen, so nothing does. Each of these is survivable alone. Together they produce the characteristic shape of ungoverned industrial AI: impressive pilots, unaccountable production, and a growing museum of disconnected assistants.
The principle. The question is never whether the model is smart enough. It is whether the architecture lets it know what it needs, act only where it should, and leave a record of both. That is what this layer enforces, and it enforces it in the infrastructure, not in the prompt.
How it works
The whole layer in two requests: reasoning where reasoning is needed, thrift where it is not, and a record of both in the Feedback Data Layer.
The router comes first, and its discipline is economic. Every incoming task is weighed on four axes, complexity, domain, latency, and cost, and dispatched accordingly across three tiers: lightweight models at the edge for sub-second work, domain-specific models for the jobs where specialized training beats general capability, and general-purpose enterprise models for deep, cross-domain reasoning. The rule is the cheapest sufficient model, and it cuts both ways: no flagship tokens spent on shift-report summaries, and no undersized model left holding a root-cause analysis. When an edge-tier attempt cannot resolve a task, vertical escalation hands it up the tiers with its context intact, so difficulty is discovered cheaply rather than guessed in advance.
Context injection does the grounding before any model is prompted: the router pulls the relevant batch, equipment, and parameter context from the governed layers, the live state from the namespace, history and relationships from the data layer and its graph, all named in the shared language. This is the architectural answer to hallucination: the model is not asked to remember the plant, it is shown the plant, from sources with lineage.
The agents put the routed intelligence to work, and they work the way the plant does: by domain, in collaboration. A quality agent, a maintenance agent, and a supply chain agent each own their territory, share results horizontally when a question crosses boundaries, and exercise the layer's two signature capabilities. Anomaly detection and root-cause analysis: flagging deviations and correlating critical process parameters, lots, and work orders, which is graph traversal put to investigative work. And CAPA generation: drafting corrective and preventive actions and routing them to human approvers through the QMS, which is the layer's model for acting in the world generally. Agents act through the systems of record, with the approvals those systems already enforce, not around them.
The safety machinery wraps around all of it. Human-in-the-loop fallback routes low-confidence tasks to subject-matter experts, with the handoff logged in the Feedback Data Layer like any other outcome. Policy and guardrails run in the infrastructure: prompt filtering, PII masking, and token-level audit logs, so what models are asked and what they answer is itself a governed record. And one rule is universal, the layer's contract with the architecture: every inference, every action, and every outcome writes back to the Feedback Data Layer. Nothing this layer does is off the record, which is precisely why it can be trusted with more over time.
What it consumes and provides
What the layer consumes: live plant state from the Unified Namespace, by subscription; history, digital-thread joins, graph traversals, and point-in-time features from the Unified Data Layer; the vocabulary and relationships of the Common Data Models, which are what context injection injects; improved models from the Feedback Data Layer's retraining loop; and tasks, from people, from workflows, and from events on the namespace that agents watch for.
What the layer provides: every inference and action written to the Feedback Data Layer, without exception; recommendations delivered into the systems of record, CAPA drafts to QMS approvers, work orders to the CMMS, schedule proposals to planning, where human authority already lives; the next generation of edge models, signed and versioned, deployed down to the Edge Intelligence Hub through the MLOps path; and answers to people, grounded and lineage-backed. Note the shape of its write paths: this layer acts through governed transaction systems with their approvals intact, which is how detect, decide, act stays compatible with a regulated plant.
A worked example: Batch 42, explained
Finish the running example, and notice that it began in this layer without saying so: the vibration model that scored 4.2 millimeters per second at 02:14 was this layer's edge tier, running in the hub's inference slot, doing sub-second work where the latency budget lives. The rest of the architecture carried that claim, judged it, and learned from it. Now, weeks later, the deviation investigation brings the scenario home with a request typed by a quality engineer: explain why Batch 42 deviated.
The router weighs it: cross-domain, evidence-heavy, nobody needs the answer in a second, and dispatches it to an enterprise model with the full treatment. Context injection assembles what six layers built: the batch record and temperature curve from the data layer, the alert and its closed feedback record, accepted, e-signed, bearing wear confirmed, the drift insight tying the vibration inputs to the resin supplier change, and the graph traversal from Reactor A through Batch 42 to Resin lot R-19 and its sibling lots across sites. Along the way the quality agent asks the maintenance agent for the bearing history and the supply chain agent for the lot genealogy, horizontal collaboration doing quietly what used to be three weeks of meetings.
The answer comes back grounded: the deviation reflects an interaction between early bearing wear, caught by the edge model, and the harmonic characteristics of the new resin lots, with every claim citing its records, the traversal, the feedback entries, the drift analysis, so the investigator is reviewing evidence, not prose. Asked next to draft a CAPA, the agent produces one, add a changeover-triggered bearing inspection, extend incoming qualification for the new supplier's lots, and routes it into the QMS, where it arrives as a draft awaiting human approval. The signature is the quality manager's, as it should be: the agent did the assembly, the human owns the call.
And for contrast, the same afternoon someone asks for a summary of the shift report. The router sends it to a lightweight local model, and the answer costs pennies and returns in milliseconds. That is the whole layer in two requests: reasoning where reasoning is needed, thrift where it is not, and a record of both. Sixty seconds of plant life at 02:14, and its afterlife across six layers, is the architecture explained.
Common anti-patterns
The intelligence layer fails in recognizable ways, and most of them come from treating AI as an application rather than a governed layer. Six worth naming:
| Anti-pattern | Why it happens | What it costs | What to do instead |
|---|---|---|---|
| One model for everything | Standardizing on the flagship model is simple and feels safe | Deep-reasoning prices for trivial work, cloud latency for edge tasks, and a bill that scales with usage instead of difficulty | A router with tiers and a written policy: the cheapest sufficient model, with escalation when sufficiency runs out |
| The ungrounded agent | Wiring an agent to ad hoc extracts ships faster than wiring it to the architecture | Confident reasoning over an unverified picture of the plant; trust spent on the first wrong answer | Context injection from the governed layers only: namespace state, data-layer history, graph relationships, all with lineage |
| Prompts as the security boundary | Telling the model its limits is easier than enforcing them | A boundary that holds until someone, or something, talks the model out of it | Permissions, filtering, masking, and audit enforced in the infrastructure; the prompt states the rules, the platform enforces them |
| Fire-and-forget inference | Writing results back feels like plumbing that can wait for phase two | No accuracy record, no retraining data, no audit trail, and no evidence when the autonomy question arrives | The universal rule: every inference, action, and outcome writes to the Feedback Data Layer, from the first pilot on |
| The demo that never joins the workflow | A chat window is easy to ship; QMS and CMMS integration is not | Recommendations someone must retype to act on, so they are admired and ignored; the pilot museum grows | Agents act through the systems of record: CAPA drafts into the QMS, work orders into the CMMS, with approvals intact |
| Autonomy by vibes | A good quarter breeds excitement, a bad incident breeds fear, and authority follows mood | Agents either cut loose without evidence or leashed forever despite it, and nobody can say why | Authority decisions grounded in the feedback record: demonstrated accuracy, reviewed overrides, written bounds, and escalation designed in |
The through-line is that every one of these treats intelligence as separable from the architecture underneath it. It is not. The layer's capabilities are real, but each one is a claim drawn against the five layers below, and the anti-patterns are what bouncing those checks looks like.
What good looks like
A field test for whether the intelligence layer is genuinely working. Task routing is a written policy, and the token bill shows it: most requests land on cheap models, and the expensive ones can each say why. Every agent answer carries its grounding, and a skeptic can follow any claim back to the records behind it. Any inference from last quarter can be replayed from the Feedback Data Layer, and someone has actually done so. The low-confidence fallback fires in practice, and the expert queue it routes to is staffed and measured. CAPA drafts and work orders arrive inside the QMS and CMMS with approvers assigned, not in an inbox as text to retype. And each agent's authority, what it may do, propose, and never touch, is written down, with the most recent change citing feedback-layer evidence rather than a feeling about how things have been going.
A plant that passes those checks has an intelligence layer. One that does not has a collection of AI features, which is a different thing wearing the same demo.
Standards involved
- Autonomy levels, HITL, shadow mode, and blast radius: the trust vocabulary this layer operates in, defined in the reference
- Prompt filtering, PII masking, and token-level audit logging: the guardrails that make model traffic itself a governed record (see the Standards Crosswalk for how the pieces line up)
Design it yourself
- Specify your agents with the Agent Designer: scope, autonomy level, guardrails, escalation paths, and a qualification pack
- Benchmark this layer in the self-assessment
Where this layer fits
AI Routing & Agents is the top of the stack and the reason the rest of it was worth building. The Edge Intelligence Hubs run its fastest tier and enforce the contracts its context depends on; the Common Data Models give it a vocabulary in which the plant can be reasoned about; the Unified Namespace shows it the present; the Unified Data Layer gives it the past and the connections; and the Feedback Data Layer holds it accountable and makes it better, one judged claim at a time. Read downward, the stack is context flowing up to meet intelligence. Read upward, it is intelligence earning, layer by layer, the right to act.
Together, the six layer guides follow one minute of plant life, a temperature, a vibration, and everything both set in motion, from the moment a raw signal met the edge to the moment an agent explained it with evidence.