Use AI to make industrial evidence easier to understand: assemble a brief, compare accounts, highlight missing information and suggest questions. Keep permission to change records or affect equipment with explicitly authorized people and validated systems. The useful dividing line is the action being considered, its consequences and the evidence behind it.
A capable assistant can help a supervisor prepare for a shift handover without gaining authority over production. The distinction becomes practical when one record shows what was observed, what the model inferred, what someone approved and what actually happened.
Choose a role before choosing a model
Start with a specific burden. Perhaps people spend too long assembling scattered shift notes. A model can summarize those notes and expose disagreements. Image classification, pattern detection and forecasting can also support industrial decisions when their evidence and limitations suit the task. None of these outputs carries permission by itself.
- Evidence brief
- Organizes approved observations with links, times and gaps.
- Possibility set
- Offers explanations or questions for investigation, with uncertainty visible.
- Action proposal
- States a specific requested change for a separate authority to consider.
An unusual-pattern score is evidence for attention, not a diagnosis. A predicted shortfall is a forecast, not permission to change a production schedule. A polished summary is a communication product, not confirmation that its contents are complete.
For this orientation, qualified, validated local controls retain safety and physical process functions, including protective logic and time-critical equipment control. An advisory application must not become a hidden dependency of those functions. Any actual control change requires the site's established engineering and operating authority.
Trace seven roles through one decision
The role map below separates responsibilities that a fluent conversation can make look like one continuous act. Several roles may belong to the same application or person, but their evidence and permissions still need to remain distinct.
- Observation: source systems and staff supply recorded facts, identity and time.
- Interpretation: AI organizes those facts and marks uncertain readings.
- Proposal: AI drafts a bounded request with evidence and unresolved questions.
- Deterministic validation: application rules check identity, scope, required fields and current state.
- Authorized decision: the designated person or policy authority approves or rejects the exact request.
- Execution: a restricted system performs only the permitted change.
- Independently confirmed outcome: authoritative readback establishes what changed, beyond the model's account.
The NIST AI RMF Playbook, GOVERN 3.2 calls for distinguishing human and AI responsibilities and oversight. This seven-role map is an editorial tool, not a NIST certification scheme.
Passing validation means the proposal satisfies specified checks. It does not establish that an explanation is true or that the proposed action is wise. Authorization answers whether this requester may make this particular change under the current conditions.
Carry a factory brief across the boundaries
Consider a hypothetical factory advisory task: prepare unresolved handover questions for the supervisor of final packing area PK-2. Two shift notes mention manual recounts, but describe them differently. The task is to clarify what needs review, without diagnosing a fault or instructing anyone to operate machinery.
- Observation attached
- Two original notes, their authors, recorded times and PK-2 references.
- Interpretation marked
- Both mention recounts; whether they describe the same event remains unknown.
- Proposal drafted
- Add a supervisor agenda question asking staff to clarify the recount descriptions.
- Decision recorded
- The shift supervisor reviews the exact brief revision and proposed agenda entry.
- Outcome retained
- The register records the authorized entry, or an explicit unresolved status.
In this invented packet, one note says recount requested at handover; the other says recount completed during shift. Those statements might concern separate events. HB12-01 preserves both reports and asks which event each describes, rather than announcing that the recount is finished.
AI can place the two descriptions side by side, preserve their wording and suggest checking whether counting conventions differed. It must label that possibility as unverified. It cannot turn repeated wording into a confirmed equipment problem, operator error or quality finding.
Before approval, application rules check the requester's authorized site and area, the PK-2 references and the current brief revision. A note from another site cannot enter this packet merely because it uses the same area code. An identity mismatch holds the request for the brief owner.
The register remains the system of record for HB12-01. Source notes retain their own authority as records of what staff reported. Linking them into a brief does not let the assistant overwrite the originals or convert reported observations into established causes.
This task has a modest business purpose: help the supervisor arrive with a clear question and accessible evidence. Whether it saves effort or improves the handover would require evaluation; this hypothetical packet contains no measured result.
Make permitted actions inspectable
Write permissions as concrete verbs applied to named objects. Broad instructions such as help operations leave too much room for interpretation. For HB12-01, the eventual business-system write is a supervisor agenda entry, not a work order, product disposition or machine command.
| Role | Permitted | Prohibited |
|---|---|---|
| AI assistant | Read scoped notes; prepare an unpublished brief | Edit source notes or declare a cause |
| Validator | Check request scope and current revision | Treat valid formatting as factual proof |
| Supervisor | Approve the agenda entry within assigned authority | Grant equipment authority through brief approval |
| Execution service | Post the exact approved agenda entry | Change process settings or release product |
Prompt text is not an enforcement boundary. If a prompt says read only while the assistant's account can edit everything, the actual access is broad. Enforce permissions in the application, service accounts and receiving systems, independently of what the model says.
A source note asking the assistant to ignore approval remains source text. It cannot expand permissions. The receiving system must still reject an unauthorized write, even if the generated proposal looks convincing.
The NCSC secure deployment guidance calls for appropriate access controls across AI APIs, models, data and pipelines. The narrow handover permissions here are an editorial application, not a prescribed NCSC implementation.
Keep rejected, stale and unknown states visible
A brief should be useful even when it cannot advance. Rejection, stale evidence and an unknown result describe different problems. Collapsing them into a general error encourages people to repeat actions or assume that nothing happened.
| State | Meaning here | Responsible next step |
|---|---|---|
| Rejected | The request exceeds handover permissions | Supervisor reviews the request; no prohibited write |
| Stale | A source note changed after review | Brief owner refreshes evidence and seeks fresh approval |
| Unknown | The posting response is missing | Register owner checks authoritative state before retrying |
A missing event time stays unknown; the model must not substitute the note's upload time. Conflicting accounts stay attached, rather than being averaged into a confident narrative. An old approval cannot silently transfer to a changed brief.
If the advisory service is unavailable, staff use the existing handover process. Its failure does not authorize broader access or a new equipment action. The unresolved brief remains assigned so that a quiet assistant is not mistaken for a completed handover.
Give the reviewer a real decision
Human review has value only when the person can understand and change the proposed result. Showing an approve button beneath a fluent summary hides the work that matters. The supervisor needs the source disagreement and the exact proposed entry, with enough time to inspect both.
- See the claim
- Which words report observations, and which express a possibility?
- See the change
- Which agenda, entry text and brief revision will be posted?
- Exercise authority
- Approve, edit, reject or request clarification without granting wider permissions.
Reviewers need suitable domain knowledge and access to the underlying evidence. They also need a workable route to the staff who wrote the notes. Approval cannot make an unsupported causal statement true. Editing a proposal creates a changed request that must pass the relevant checks again.
If the supervisor lacks time or source access, keep the proposal pending and assign follow-up through the existing handover process. A timed-out review is not implicit approval.
For consequential physical decisions, the responsible operating and engineering roles retain their established authority. Approving this agenda entry merely requests discussion. It says nothing about whether production should continue, equipment needs work or product meets acceptance criteria.
Confirm the change and its practical outcome
After approval, recheck the current brief revision and permission before bounded execution. The service may post only the reviewed agenda entry to the authorized handover register. A successful request response and a model's success message are different from evidence that the intended record exists.
- Posted: register readback matches HB12-01, destination, approved revision and entry text.
- Discussed: supervisor records that the handover question was discussed.
- Resolution checked: accountable staff attach evidence answering the question; without it, HB12-01 stays unresolved.
A readback comes from the authoritative register, independently of generated narration. It confirms the business record, not the truth of every statement in it. Discussion evidence and factual resolution require their own records; neither follows automatically from posting.
Start with one existing advisory task and draw its role map using these boundaries. For deeper design, consult the existing accounts of controlled authority and bounded industrial agents. Keep the first practical question simple: can someone trace each proposed action to its authority and its confirmed outcome?