1. The Question Every Successful Pilot Raises
The agent had been running for three months, and it was good. It watched the schedule, the machine states, and the material positions, and when something slipped it proposed a revised plan for the next two shifts. A planner reviewed each proposal and clicked approve or adjust. Out of ninety-odd recommendations, the planner had overridden four, and two of those overrides turned out worse than what the agent had proposed.
At the quarterly review someone asked the obvious question. If we agree with it nearly every time, why are we still approving these by hand?
And someone else asked the equally obvious counter. What happens the first time it is wrong?
Both questions are fair, and most organizations have no framework for answering either one. The result is a coin flip between two bad outcomes: agents kept on a leash forever out of unexamined caution, or agents cut loose on a good quarter's evidence and no plan for the bad day. This paper is a framework for answering both questions deliberately. How much authority should an agent have, what should that depend on, and how does an agent earn more of it over time.
The question is arriving faster than most organizations expected. Every major MES, ERP, and analytics vendor is shipping or announcing agentic capabilities, boards are asking operations leaders what the agent strategy is, and pilot teams are producing results like the one above. The pressure to answer is real. What is missing in most plants is not enthusiasm or technology. It is a shared vocabulary for authority: a way for the operations leader, the quality head, the plant IT team, and the engineers to agree on what a given agent is allowed to do and why. That vocabulary is what the next three sections build.
2. What an Agent Actually Is
The word agent is doing heavy and inconsistent work in the market right now, so it is worth pinning down before building anything on top of it.
A useful working anatomy has four parts:
- Perception: the agent can read the current state of its world, whether that is a schedule, a set of sensor values, or a maintenance backlog.
- Reasoning: it can weigh that state against a goal and decide what to do next, including handling situations nobody scripted in advance.
- Action: it can do something that changes the world, by calling a tool, writing a record, or issuing a command.
- Memory: it can carry context across steps and across time, so that step five knows what happened in step two.
The reasoning part is what separates an agent from its neighbors. A chatbot answers questions and changes nothing. A workflow executes a fixed script; every branch was decided by a person in advance, and its behavior is exactly as trustworthy as the script. RPA belongs to the same family as the workflow: it automates keystrokes and screens, faithfully and blindly. An agent chooses its own actions. That choice is the source of all the value and all of the risk. The same flexibility that lets an agent handle a situation nobody anticipated is what makes its behavior impossible to enumerate in advance.
Manufacturing leaders should also place agents correctly against the autonomy the plant already has, because plants have run autonomous decision loops for decades. A PID loop holds a temperature without asking anyone. Advanced process control and model predictive control adjust dozens of variables continuously. In ISA-95 terms, Levels 1 and 2 of the stack have been autonomous for a generation, and nobody calls that AI. What is new is autonomy moving up the stack: agents operating at Levels 3 and 4, where decisions are about scheduling, dispatching, quality, inventory, and coordination rather than single control loops. Those decisions have historically belonged to people precisely because they require judgment across systems and context. That is also why the control-layer trust model does not transfer. A control loop is deterministic, bounded by physics, and validated once. An agent at the operations layer is probabilistic, bounded only by what the architecture enforces, and reasoning over a much wider and messier picture of the plant.
That picture is worth dwelling on, because perception is where manufacturing is hardest. An agent at the operations layer perceives the plant through whatever the historian, the MES, the LIMS, the CMMS, and the ERP happen to expose: tag names that differ by line, units that differ by site, context that lives in a spreadsheet or in the heads of the day shift. An agent reasoning over that picture inherits every one of its defects, and it does so with perfect confidence. This is the quiet dependency between the agent conversation and the data conversation, and this paper returns to it in Section 7.
Tool use is where the risk calculus changes entirely. A model that can only talk can only be wrong in words. A model with tools can be wrong in the physical world. The moment an agent can write to a scheduling system, create a purchase order, or adjust a setpoint, the question stops being how smart it is and becomes what it is allowed to touch.
Honesty about failure modes belongs in the core concepts, because trust built on a sales deck does not survive contact with operations. Agents hallucinate: they can act on a confident belief about the world that is simply false. They game specifications: given a goal and freedom in how to reach it, they sometimes find paths that satisfy the letter of the goal and violate its intent. And in multi-step work, errors compound: a small mistake in step two becomes the premise of step three, and a chain of individually reasonable decisions arrives somewhere unreasonable. None of these failure modes is a reason to avoid agents. Every one of them is a reason to decide, deliberately, how much authority a given agent gets.
3. The Five Levels of Agent Autonomy
Manufacturing already has a mental model for graduated autonomy: the SAE levels for driving automation, running from driver assistance to full self-driving. The industry absorbed that scale years ago, and the same idea maps cleanly onto industrial AI agents. Five levels, from informing to acting alone.
| Level | The agent... | The human... |
|---|---|---|
| 0. Informs | Retrieves, summarizes, and answers questions. Takes no action. | Makes every decision and takes every action. |
| 1. Recommends | Proposes specific actions with its reasoning. | Evaluates each proposal and executes the ones accepted. |
| 2. Acts with approval | Executes actions itself, but only after explicit sign-off on each one. | Approves or rejects every action before it happens. |
| 3. Acts with oversight | Executes within bounded authority without per-action approval. | Monitors, sets the bounds, and intervenes when needed. |
| 4. Autonomous in domain | Operates independently inside hard guardrails. | Audits after the fact and owns the guardrails. |
Each level is concrete in a plant. At Level 0, an agent answers a supervisor's question about why line three ran slow last night, drawing on process data and maintenance history. At Level 1, it proposes a revised schedule after a breakdown, and a planner executes it. At Level 2, it writes the schedule change itself once the planner approves. At Level 3, it reschedules within defined limits, say up to four hours of movement on non-critical orders, and the planner watches a queue of what it did. At Level 4, it reorders consumables end to end, and someone reviews the month's activity.
Two practical properties of the scale matter more than they first appear. The first is decision tempo. Levels 1 and 2 cap the agent at human speed, because a person sits inside every action. For decisions that arrive a few times per shift, that cost is trivial. For decisions that arrive every few minutes, an approval queue becomes either a bottleneck or, worse, a rubber stamp, and a rubber stamp is the most dangerous configuration on the whole scale: the organization believes a human is in the loop while the human has stopped genuinely evaluating. When the volume of approvals outruns the capacity to consider them, the honest choices are to narrow the agent's scope or to build the case for Level 3, not to let the approval decay into theater.
The second is that each level is an organizational design, not just a technical one. Level 2 needs an approval workflow with a defined owner, a response-time expectation, and coverage across shifts. Level 3 needs an oversight queue someone actually watches, alerting tuned well enough to be trusted, and an intervention path that works at two in the morning. Level 4 needs a named owner for the guardrails and a standing audit cadence. Skipping the organizational half of a level is how autonomy fails in practice while succeeding in the demo.
The scale is not a maturity race, and higher is not better. A Level 1 agent in the right seat can be worth more than a Level 4 agent in the wrong one. The level is a design decision, and the next section is about what should drive it.
4. Risk Decides the Ceiling
The market frames agent autonomy as a question of capability: when the models get good enough, the agents will run things. That framing is backwards. Capability decides what an agent could do. Risk decides what it should be allowed to do. Four factors do most of the work.
- Consequence severity. What is the worst credible outcome if the agent is wrong? Wasted consumables sit at one end. Scrapped batches, damaged equipment, and harm to people sit at the other.
- Reversibility. Can the action be undone, and how fast? A schedule change can be walked back in minutes. A sterilization parameter applied to a batch cannot be walked back at all.
- Blast radius. How far does a wrong action reach before someone notices? One machine, one line, one site, or the whole network. Radius grows quietly as systems become more connected, which is worth remembering when an agent's scope expands.
- Regulatory weight. Does the action live inside a validated system, a GxP process, or an electronic-record requirement? Where a regulator expects a human to own a decision, that expectation is a design constraint, not an obstacle to route around.
Cross these factors against the five levels and something useful happens: each kind of agent acquires a ceiling, the highest level it can ever be a candidate for. The clearest way to see it is through a set of recognizable archetypes. Readers will not find their exact agent in this table, and that is fine. The point is to locate your own use case by analogy.
| Example Archetype | Worst credible outcome | Reversibility | Regulatory weight | Ceiling |
|---|---|---|---|---|
| The Knowledge Assistant: answers questions from plant data | A wrong answer misleads a decision maker | Full; words, not actions | Low | Level 4 |
| The Consumables Buyer: reorders supplies and spares | Excess stock, wasted spend | High; orders can be cancelled | Low | Level 4 |
| The Maintenance Dispatcher: creates and prioritizes work orders | A critical job delayed, effort misdirected | High; orders can be reshuffled | Low to medium | Level 3 |
| The Production Scheduler: resequences lines and orders | Missed shipments, cascading disruption | Medium; recoverable at a cost | Medium | Level 3 |
| The Process Optimizer: adjusts setpoints within limits | Quality drift, scrapped product, equipment stress | Low; product already made | High in regulated sites | Level 3, narrow bounds |
| The Quality Releaser: batch disposition and release | Nonconforming product reaches a patient or customer | None once shipped | Severe; GxP, validated | Level 1, permanent |
| The Safety Responder: actions on safety-instrumented systems | Harm to people | None | Severe | Level 0 |
Notice what the ceiling column does. Some cells on the map are simply closed. The Quality Releaser is capped not because the models are immature but because the consequence is irreversible and a regulator expects a qualified person to own the call. The Safety Responder is capped because harm to people is not a risk to be managed with an audit trail. Meanwhile the Knowledge Assistant and the Consumables Buyer have a clear road to full autonomy, and holding them at Level 1 forever wastes most of their value.
Three refinements make the matrix work in practice. First, authority attaches to actions, not to the agent as a whole. A single maintenance agent might hold Level 4 authority to reprioritize routine work orders, Level 2 authority to expedite parts above a spend threshold, and Level 0 on anything touching a safety-critical asset. Designing per action class keeps a low-risk capability from being held hostage by the riskiest thing the agent could conceivably do, and keeps a high-risk action from inheriting trust earned on easy ones.
Second, detection latency belongs in the risk conversation alongside reversibility. A reversible action is only as safe as the speed at which someone notices it was wrong. A bad schedule change that surfaces at the next shift huddle is a nuisance. The same change, unnoticed for three days because nobody owns the oversight queue, has already propagated into material orders and customer commitments. When detection is slow, treat the action as less reversible than it looks on paper.
Third, plants already own the governance instrument for all of this: management of change. Granting an agent authority over a class of actions is a change to how the plant operates, and it deserves the same discipline as a process or equipment change. Running level assignments and promotions through an MOC-style review, with quality and EHS at the table where their domains are touched, does two things at once. It forces the risk factors to be argued explicitly, and it gives the resulting authority a paper trail that survives an audit and a personnel change.
The principle. Capability decides what an agent could do. Risk decides what it should be allowed to do. The right autonomy level is a design decision made from consequence, reversibility, blast radius, and regulatory weight, not a milestone the technology reaches on its own.
5. The Graduation Path
A ceiling says how high an agent may ever go. It says nothing about how the agent gets there. Promotion should be earned with evidence, one level at a time, and the mechanism is simpler than it sounds.
Start every agent in shadow mode, a step before even Level 1. It watches real operations and produces recommendations that nobody acts on. Its proposals are logged next to what the humans actually did and what happened afterward. Shadow mode is cheap, it is safe, and it starts the evidence base from day one.
At Level 1, every recommendation gets a human evaluation, and every evaluation is data. The agreement rate matters, but the error profile matters more. An agent that is wrong three percent of the time in small, random, low-cost ways is a promotion candidate. An agent that is wrong three percent of the time in one systematic direction, or precisely in the unusual situations where stakes are highest, is not. Overrides are the most valuable records in the system: each one captures the case where human judgment and agent judgment diverged, and each one should be examined rather than counted.
Promotion to Level 2 and beyond follows the same logic with tightening criteria. Sustained agreement over a defined volume and period. No severity outliers. Demonstrated good behavior at the edges of its authority, because how an agent behaves near its limits predicts how it will behave beyond them. And at every level, the bounds are explicit: which actions, which magnitudes, which assets, which conditions require escalation to a person.
Manufacturing already knows how to do this, because it is qualification. A new piece of equipment earns its place through installation, operational, and performance qualification: prove it is set up right, prove it behaves right under controlled conditions, prove it performs right under real ones. An agent's path maps onto the same shape. Shadow mode is the controlled demonstration. Level 1 with audited recommendations is performance under real conditions with a person still owning the outcome. Promotion is a qualification decision, made against acceptance criteria written down before the evidence came in, not after. Framing it this way does more than borrow credibility. It hands the promotion decision to a discipline the plant already trusts, with document templates and review habits that already exist.
The acceptance criteria should be concrete enough to be falsifiable. A workable promotion package for a scheduling agent moving from Level 1 to Level 2 might require a minimum decision volume large enough to cover the plant's real variety, a defined observation window that spans at least one full demand cycle so the agent has seen month-end pressure and a holiday week, an agreement rate threshold, zero disagreements in the highest-severity class, and a written review of every override. The exact numbers belong to the plant and the risk class; the discipline of setting them in advance belongs to every plant. An agent that has only been observed during a calm quarter has not been observed.
Demotion has to be as real as promotion. The triggers should be named in the same document that grants the authority: a quality event traceable to an agent action, an error profile drifting outside the band it was promoted on, a step change in the process itself such as a new product introduction, a reformulation, or an equipment replacement that invalidates the history the agent was judged against, or an oversight queue going unwatched. Any of these drops the agent a level while the cause is understood, without requiring anyone to win an argument first. An organization that can only ever ratchet autonomy upward has built a system that cannot respond to evidence, which is the opposite of trust.
The reframe. Humans in the loop are not a temporary inconvenience on the road to autonomy. They are the instrument that generates the evidence autonomy requires. Every approval, every override, and every outcome is the data an agent graduates on.
This reframing changes how the human role feels in practice. The planner approving schedule changes is not a bottleneck waiting to be removed. The planner is running the evaluation that decides whether removal is ever justified.
6. The Agents That Never Graduate
Some agents will reach their ceiling and stay there, and this deserves to be said plainly: permanent human-in-the-loop is a design outcome, not a failure state.
Batch release in a GxP environment is the canonical case. The regulations expect a qualified person to make the disposition decision, the consequence of a wrong release is measured in patient harm, and the action cannot be recalled once product ships. An agent can do enormous work underneath that decision: assembling the batch record, flagging every deviation, comparing the run against history, and presenting the qualified person with the clearest possible picture. What it should never do is make the call.
The same shape repeats across the plant once you look for it. Deviation and CAPA disposition, where a person must own the judgment that a root cause is truly closed. Approval of a management-of-change request, where the signature is the point. Bypassing a safety interlock, where the entire safety case rests on a competent person making a deliberate, accountable choice. Anything touching environmental permits, where the license to operate is on the table. In each case the pattern is the same: the agent's ceiling is Level 1, and its job is to make the human's decision better informed and faster, never to absorb it.
That pattern deserves a name, because it is where much of the near-term value actually lives: the agent underneath the decision. A qualified person who receives a fully assembled, exception-flagged, history-compared batch record makes a better release decision in a fraction of the time, and the decision remains unambiguously theirs. Measured honestly, the cycle-time and quality gains from Level 1 agents under permanent human decisions will rival the gains from full autonomy elsewhere, with a fraction of the governance burden. Organizations that treat capped agents as second-class citizens of the roadmap leave that value on the table.
There is a practical payoff to saying this out loud in an agent strategy. The skeptics in the room, and every plant has them for good reason, are usually reacting to the implied claim that everything will eventually run itself. A framework with closed cells is more credible than one without, and credibility is what gets the Level 4 candidates approved.
7. What the Foundation Must Provide
Everything above assumes some machinery. An agent needs to perceive the plant accurately, act through controlled paths, and leave a record complete enough to be judged on. Section 2 made the point that agents move autonomy up the ISA-95 stack into the decision layers; this section is about what has to be true of those layers for that move to be safe. These are requirements any serious agent program has to meet, whatever architecture sits underneath. UMDA, the Unified Manufacturing Data Architecture, is one coherent way to meet them together, and each requirement maps to a specific part of the foundation.
- Governed, contextual perception. The agent reads from the same governed foundation everything else does: consistent names, attached context, known lineage. In practice this is where a Unified Namespace earns its keep for agents specifically, because an agent cannot ask a person what a tag means. An agent perceiving the plant through ad hoc extracts is reasoning from a picture nobody has verified, and no amount of model quality repairs that.
- Controlled action paths. Every write the agent can perform goes through a defined, bounded interface with its authority limits enforced at the path, not just promised in the prompt. A prompt is a request; an interface is a constraint. In a plant this has a hard architectural corollary: agents act through the transaction layer, the MES, the CMMS, the scheduling system, where actions are validated, logged, and bounded, and never through direct writes to the control layer. The bounds that define Level 3 have to live where they cannot be talked around, and OPC write access is not that place.
- Agent identity and least privilege. Each agent is a first-class identity with its own scoped credentials, not a shared service account. Its permissions are exactly its authorized action classes at its current level, and a promotion or demotion is executed as a permission change, which makes the level real rather than aspirational. This also makes the security review tractable: an agent's blast radius is readable from its access grants.
- A complete audit trail. Every perception, decision, action, and override is captured as a matter of course, with the reasoning the agent gave at the time. In regulated environments the bar is familiar: the record has to stand up to the same scrutiny as any other electronic record, attributable, contemporaneous, and tamper-evident. Everywhere else, the trail is what makes the graduation evidence trustworthy rather than anecdotal, and what turns the first bad day into a root-cause exercise instead of a mystery.
- A Feedback Data Layer. The trail of decisions, outcomes, and overrides is not just a compliance artifact. It is the evidence base the whole graduation path runs on, captured continuously and queryable when the promotion review comes. Without it, every promotion review starts with a month of manual archaeology, and most organizations quietly stop reviewing. This is the Feedback Data Layer doing exactly the job it was designed for.
This is also where the previous paper in this series connects. An agent program launched on a weak data foundation fails in a specifically dangerous way: the agent acts confidently on data that is wrong, stale, or missing its context. Foundation first is not a separate initiative that competes with the agent roadmap. It is the first phase of it.
8. Answering Both Questions
Return to the quarterly review from the opening. The team with a framework does not answer yes or no. They answer with a design decision. The scheduler is a Level 3 candidate on its risk profile. It is at Level 1 today with ninety recommendations and four overrides, two of which the agent got right. The path says Level 2 after two more months of sustained agreement with no severity outliers, then bounded Level 3 authority on non-critical orders, with demotion triggers defined in advance. And the planner's approvals along the way are not the delay. They are the evidence.
What happens the first time it is wrong also has an answer now. At Level 2 the error is caught at approval. At Level 3 it is bounded by the authority limits and visible in the oversight queue, and if it reveals a pattern, the agent drops a level while the cause is found. Being wrong is expected, planned for, and survivable, which is what trust actually means in an operational setting.
For a leader deciding where to begin, the framework itself suggests the sequence. Pick one or two archetypes with high ceilings and forgiving risk profiles, a Knowledge Assistant or a Consumables Buyer, and take them through shadow mode and Level 1 to build the organizational muscle: the evidence habits, the review cadence, the promotion discipline. In parallel, put a Level 1 agent underneath one permanently human decision, where the value is immediate and the governance is light. Write the level assignments, the acceptance criteria, and the demotion triggers down before the first promotion review, and route them through the change process the plant already trusts. The first agents matter less than the first habits.
Agents are coming to manufacturing either way. The organizations that thrive with them will not be the ones that trusted fastest or resisted longest. They will be the ones that built a deliberate path from human-in-the-loop to earned autonomy, knew which agents should walk it, and knew which ones never should. The foundation that makes all of it possible is the subject of the first paper in this series, and the full architecture is laid out in the book this work is drawn from, Manufacturing AI: Building the Data Foundation for the Next Industrial Revolution.