# Line of business and OT
Agents advise the people who run grids, plants and field work, and never control equipment. Every suggestion is checked in a simulation before display, advice stays apart from alarms, and a person approves every change to the asset register.
Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/layers/r05-lob-and-ot
Published: 2026-08-20
Updated: 2026-10-15
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Line of business and OT. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r05-lob-and-ot
---
The line of business and OT layer (R05) runs the physical work. OT, operational technology, means the systems that control physical equipment. This layer holds grid and plant control, alarms, meters, field crews and hospital department systems. It is one of the [fourteen layers](/layers). Agents here watch alarms, tidy asset records and find past cases for a crew. They never control equipment. For agents this layer must provide three things. Agents get a read-only copy of plant data. Every suggestion passes a simulation check. Advice travels in its own channel, apart from alarms.
## Agents advise, people and fixed systems control [#agents-advise-people-and-fixed-systems-control]
Agents sit on the information path, never the control path. The information path carries data and advice to people. The control path carries commands to equipment. A person, or a certified safety system, keeps control of anything physical.
Anything that moves physical equipment is in the safety actuation zone, one of the four [deterministic zones](/architecture/deterministic-zones#safety-actuation). In that zone only fixed rules and named people decide. Any exception is a separate engineering decision, with its own safety case.
## What sits in this layer today [#what-sits-in-this-layer-today]
| System category | Electricity distributor | Water utility | Hospital network | Generator, oil and gas, or miner |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Control systems | SCADA, distribution management (ADMS) and outage management (GE Vernova, Schneider, Siemens, Oracle NMS) | SCADA (Schneider Geo SCADA Expert, AVEVA, Citect). Remote units and PLCs. Treatment plant control | Building management. Nurse call. Medical devices | Distributed control systems (Emerson, ABB, Siemens, Yokogawa, Honeywell). Turbine control. Wellsite and plant SCADA |
| Safety and protection | Substation automation and protection relays | None listed | None listed | Safety instrumented systems (Triconex, HIMA, Honeywell). Collision avoidance and fatigue monitoring for miners (Hexagon, Seeing Machines) |
| Plant data history | Historian (AVEVA PI) | Historian (AVEVA PI) or SCADA history | None listed | Process historian (AVEVA PI System), counted in the [data platform (R02)](/layers/r02-data-platform) |
| Monitoring and analytics | Management of rooftop solar and batteries (DER management) | Network event analytics (TaKaDu, StormHarvester, Xylem). Leak sensors | Bed and patient flow (TeleTracking, Epic, Cerner) | Condition monitoring (Bently Nevada, Emerson AMS). Asset performance management (AVEVA, GE Vernova, Aspen Mtell). Alarm management (Hexagon PAS) |
| Meters and measurement | Smart meter head-end (Itron, Landis+Gyr, EDMI, Secure) | Digital meter head-end (Itron Temetra, Taggle) | None listed | Belt scales and on-stream analysers for miners. Emissions monitoring (CEMS) |
| Field work and fleets | Field mobility (SAP FSM, Salesforce Field Service, IFS, Oracle FSM). Vegetation and inspection platforms | Field mobility | Community health systems (CHIME in NSW) | Fleet management for miners (Modular Mining, Cat MineStar, Wenco). Autonomous haulage (Komatsu FrontRunner, Cat Command) |
| Departments, planning and optimisation | Network planning (PowerFactory, PSS SINCAL, CYME). Contact centre (Genesys, Amazon Connect, NICE) | Hydraulic models (InfoWorks WS Pro, WaterGEMS). Contact centre | Emergency, theatre, maternity, ICU and oncology systems (Epic, Cerner, Philips, Varian, Elekta) | Advanced process control (AspenTech, Honeywell). Mine planning (Deswik, Maptek, Datamine). Geology models (Seequent Leapfrog) |
The standards between these systems: plant data moves over DNP3, IEC 60870-5-104, IEC 61850, Modbus and OPC UA. ISA-95 and the Purdue levels place each system. ISA-18.2, IEC 62682 and EEMUA 191 govern alarms. IEC 61511 and IEC 61508 govern safety systems. Medical devices follow IEEE 11073 and AS/NZS 3551. Vendor names are examples from industry knowledge (typical, unsourced). The full estates are on the [utilities](/use-cases/utilities), [healthcare](/use-cases/healthcare) and [energy](/use-cases/energy) pages.
## What agents add [#what-agents-add]
Agents bring context an operator cannot hold in their head. They read alarms alongside history, reconcile asset data across systems that disagree, and find past cases for the crew. Here the tool gateway, one of [the seven capabilities an agent platform provides](/architecture/system-view), meets the OT boundary.
### Four patterns [#four-patterns]
Four patterns describe what agents can do in this layer. They differ in how much evidence stands behind them.
* **Pattern A: alarm advice in the control room.** The agent reads the alarm stream from SCADA, the supervisory control system, and suggests what to check. Vendors already ship the suggestion half. The part worth designing is the validation loop below.
* **Pattern B: a compliance checking agent.** It would check records against grid security rules. It is a design proposal only, with no published example. Sector adoption of compliance automation is about 2 percent. The agent would also fall under those security rules itself.
* **Pattern C: a safety coach for crews.** It would bring relevant past incidents to a crew before a job. No production example exists. The nearest work is a 2026 benchmark study whose authors make no outcome claims.
* **Pattern D: an asset data quality loop.** The agent finds asset records that disagree and proposes fixes. A person approves each change to the asset register. This is the strongest pattern, and the only one with a measured result.
Pattern D is a [learning flywheel](/architecture/learning-flywheel): each approved fix improves the data the next check uses. Its key design decision is the approval step for register changes. Asset changes flow into the regulated asset value, ISO 55001 evidence and regulatory reports. Capturing better data in the field is a change to how people work and are rewarded. No AI feature does that part.
### The validation loop [#the-validation-loop]
The operator never sees the model's raw answer. The US National Renewable Energy Laboratory (NREL) published eGridGPT in May 2024. It is a reference design for a grid control room. Staff from two US grid operators, CAISO and ERCOT, reviewed it. The model suggests possible actions. A simulation of the grid, called a digital twin, tests each one. Unsafe options are removed. The operator sees only the options that survive, and decides.
Build this loop before you build the suggestions, because the suggestion half already ships. Honeywell's Alarm Guidance, built with Chevron, shipped on 1 October 2024 \[vendor]. A pilot at TotalEnergies Port Arthur gave operators 12 minutes' notice of pressure problems (November 2025) \[vendor].
### The alert channel [#the-alert-channel]
Agent output goes in the alert channel, kept visually apart from real alarms. EEMUA 191 Edition 4 (November 2024) is the Engineering Equipment and Materials Users Association's alarm management guide. It defines an alert as information the operator need not respond to, but can. That channel is the right home for agent advice.
Agent advice never counts as a safety protection. A protective alarm needs a defined proof test. An output that can change from run to run cannot pass one. The channel also has load limits. In steady state, aim for at most one alarm per operator every 10 minutes. In a major upset, aim for at most 10 in the first 10 minutes. At BP-Husky Toledo in September 2022, 3,712 alarms sounded in 12 hours. Two workers died. The US Chemical Safety Board named the alarm flood as a contributing factor (June 2024).
### The measured economic result [#the-measured-economic-result]
One measured result exists, and it is a data task. NREL's eGridGPT converted grid models from the control room format to the planning format in under a minute. Regional staff had needed several weeks for the same job. The result met NERC's model validation standard, MOD-033. A specialist still checks it. So value here is counted in specialist hours, avoided field visits and deferred replacement, not in tokens. Data access holds progress back. EPRI, the US power industry's research institute, puts about 95 percent of utility data behind security and privacy walls.
### One narrow AI does run plant control [#one-narrow-ai-does-run-plant-control]
Some AI already controls plants. Yokogawa's FKDPP is a reinforcement learning agent, a model trained by trial and reward. It runs direct control at two named plants. At ENEOS Materials, it was adopted permanently in March 2023 after an 840-hour trial. Steam and carbon dioxide fell 40 percent \[vendor]. At Aramco's Fadhili gas plant, it was commissioned in phases from October 2024 to April 2025. Amine and steam use fell 10 to 15 percent \[vendor].
It earned that place in a specific way. It has a small, bounded set of actions on a well-understood unit. It was trained on a detailed simulator, never the live plant, and tested before commissioning. The independent safety system was left untouched. It is not a language model. Language model agents stay on the information path. Closed-loop AI control is a separate engineering discipline, with its own safety case.
Vendors are now testing that line. Honeywell's Experion Cognition (9 June 2026) says it will "proactively act on behalf of the operator" \[vendor]. It runs as a live proof of concept at Borouge's Ruwais plant. It sits inside the control vendor's own system, so like FKDPP it needs its own safety case. DataRobot and Chevron (2 June 2026) aim to replace per-mission permit approval for robot inspections with continuous checks \[vendor]. Cognite and ABB (21 May 2026) say their agents can "trigger cross-system actions" \[vendor]. None of the three says what its agents may not touch. On this site, control of equipment and of work permits stays with a person.
### The parts and where they run [#the-parts-and-where-they-run]
| Part | What it does | Where it runs |
| --------------------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| Validation loop | Tests each suggestion in a simulation or against rules before display | The control room estate, beside the energy or distribution management system |
| Alert channel | Carries agent advice to the operator, apart from alarms | The alarm management system and operator screens |
| OT read broker | Serves copies of plant data to agents, with logs and a kill switch | The buffer zone (DMZ) between plant and office networks |
| One-way path | Sends cleaned plant data out, with nothing coming back | The OT boundary, as a data diode or push design |
| Local model runtime | Runs open-weight models with no public network access | Inside the operator's perimeter |
| Asset change gate | Sends proposed register fixes to a person for approval | The asset management system |
| Revert-to-manual path | Returns control to people or fixed systems, and switches AI features off | The control system estate |
## What must be true before an agent touches it [#what-must-be-true-before-an-agent-touches-it]
### The OT boundary: four principles [#the-ot-boundary-four-principles]
Nine national cyber agencies published joint guidance on 3 December 2025. Its title is "Principles for the Secure Integration of AI in Operational Technology". It explicitly covers AI agents. The agencies come from the US, Australia, Canada, Germany, the UK, the Netherlands and New Zealand. It sets four principles.
* Keep the ability to go back to manual or fixed control.
* Prefer one-way or push-based data paths, so OT networks stay separate.
* Send cleaned OT data out to separate AI systems. Do not put models inside safety-critical loops.
* Require a parts list for AI components, and a way to switch AI features off.
Ofgem, the UK energy regulator, adds two warnings in its May 2026 AI guidance. It names shutdowns that cascade. It asks for safety-style guardrails and for training operators to spot faults.
### Existing standards still apply [#existing-standards-still-apply]
No grid or industrial security standard has an AI part yet. The existing rules still cover any agent that touches regulated systems. IEC 62443 treats the agent as a new kind of actor in a network zone. NERC CIP, the North American grid security rule set, captures agents by what they touch. A compliance agent that reads protected grid information falls under CIP-011 itself. Its model and settings become a change-managed baseline under CIP-010. Inside the protected network perimeter, CIP-005 and CIP-007 apply. That is one reason the published control-room work runs open-weight models locally.
### Two human-factors failure modes [#two-human-factors-failure-modes]
Good advice makes people check less. When decision support is right about 85 percent of the time or more, operators check 40 to 60 percent less. So watch the checking rate beside the acceptance rate.
One confident answer can also narrow what a crew notices. Operators take in handover notes, sounds, vibration, smells and site conditions. A search agent that shows one confident matching case can crowd those out. It can anchor a crew on the last accident.
NERC said in November 2024 that the operator should have the final say on AI-generated actions. Ofgem asks for human oversight designed in from the start. It must allow for both overconfidence and distrust. Ofgem does not require a person in the loop. Its rules are based on outcomes.
### The controls [#the-controls]
* **Reads go through a broker or a one-way path.** If agent output could ever influence a control action, the path is one-way and physically enforced.
* **Each agent has its own identity and the least access it needs.** Access can be cut in seconds. Plant assets without a registered name cannot be reached. The identity rules come from [security and identity (R10)](/layers/r10-security-and-identity).
* **The operator holds the logs.** Session logs are kept by the operator, not the vendor.
* **Control-system data stays inside the perimeter.** Where it may not leave, models run locally with no public network access.
* **Going back to manual is documented and tested.** The time it takes is measured. AI features can be switched off.
* **Agent failure cannot weaken the control system.** Field agents also keep working when the network is poor.
* **A person approves every asset register change.** Each proposed fix shows its source. Changes follow CIP-010 and ISO 55001 change management.
The enforcement points are the read broker and the one-way path. Both sit outside the model. What a model reads can steer its behaviour. So behaviour cannot be the security control (Zentera, July 2026) \[vendor]. This is [enforcement outside the model](/architecture/enforcement).
## Choices and their verdicts [#choices-and-their-verdicts]
The entry below is the common choice, tested against the simplest credible alternative. The full record is in the [decision catalog](/decisions).
* [A brokered read path or a one-way path](/decisions#cd-18): it depends on where the agent's output can go. If output can reach or influence a control action, use a one-way path and a tested way back to manual. If output stays in alerts, suggestions and data findings, a broker is enough. The agent's impact decides, one of [the four questions](/architecture/agent-types). The transport comes after that decision.
## Concerns this layer must honour [#concerns-this-layer-must-honour]
A concern is a requirement every layer must honour. This layer carries a specific duty for eight of the ten.
* **Identity and access.** Each agent has its own identity and least access. Access can be cut in seconds.
* **Traceability and audit.** Every option shown is tagged with its source, agent or operator, and a time. Proposed fixes show their source.
* **Grounding.** Enforced here by the simulation check before display. Data carries its history.
* **Impersonation and authenticity.** Agent advice cannot pass itself off as an alarm. It stays in the alert channel.
* **Sovereignty and residency.** Control-system data usually may not leave the perimeter. Local open-weight models are the published pattern.
* **Privacy.** Data about field workers, such as location and performance, carries worker protections.
* **Safety and oversight.** Enforced here. The operator holds decision authority, and advice never counts as protection.
* **Resilience.** Agent failure must not weaken the control system. Going back to manual is tested.
The full grid of concerns against layers is the [concern matrix](/architecture/concern-matrix).
## Evidence and limits [#evidence-and-limits]
The validation loop rests on a national laboratory report and dated vendor releases. The four principles rest on joint guidance from nine agencies. The guidance's exact wording comes from secondary coverage, because the primary page returned access errors. Treat quoted phrasing as unverified until the source document is checked.
Adoption figures come from a NERC survey with 47 respondents (November 2024). Vendor figures are marked \[vendor].
Keeping language model agents off the control path is a design rule, not a regulation. Ofgem does not require a person in the loop. FERC has issued no guidance on AI agents in utility operations. No published alarm-triage agent runs in production in an electric utility control room. No agent holds autonomous control at any named water utility. This guide recommends the information-path rule for every language model agent.
## Next step [#next-step]
See this layer at work in [investigating a water-network anomaly](/use-cases/water-operations), where the agent reads telemetry and never writes to SCADA. Then read the next layer, [intelligence and learning (R06)](/layers/r06-intelligence-and-learning).
Explore this topic
* [Line of business and OT findings](/library/layers/r05-lob-and-ot/findings) and [sources](/library/layers/r05-lob-and-ot/sources).
**Validation loop and suggestions**
* NREL eGridGPT is technical report NREL/TP-5D00-87440, May 2024. CAISO and ERCOT staff reviewed it.
* eGridGPT runs candidate actions through a digital-twin simulation it calls RTAG.
* Honeywell Alarm Guidance, developed with Chevron, shipped on 1 October 2024 \[vendor].
* The Experion Operations Assistant pilot at TotalEnergies Port Arthur (November 2025) gave 12 minutes' notice \[vendor].
**The four patterns**
* Pattern A, SCADA alert advice: the suggestion half ships. The human-control line holds for language model agents.
* Pattern B, compliance checking: sector adoption is 2 percent. No named utility customer exists in compliance automation.
* The industry conversation about compliance runs toward auditing the AI, not automating the checks.
* Pattern C, safety coach: the nearest work is BuildSafe (June 2026), best BERTScore F1 0.7747. It is a benchmark study.
* Pattern D, asset data quality: the measured NREL model conversion supports it.
**OT boundary guidance**
* Joint guidance, 3 December 2025: "Principles for the Secure Integration of AI in Operational Technology".
* US signatories: CISA, the NSA's Artificial Intelligence Security Center and the FBI.
* Other signatories: Australia's ASD ACSC, Canada's CCCS and Germany's BSI.
* Also signed by the National Cyber Security Centres of the UK, the Netherlands and New Zealand.
* Its stance: AI should augment, not autonomously control, safety-critical actions.
* Ofgem Ethical AI guidance v2 (13 May 2026), clause 6.12: inappropriate shutdowns with cascading effect.
* Ofgem clause 6.13: functional-safety-style guardrails and operator training to spot maloperation.
* Ofgem clause 4.16: human oversight from the earliest stage, considering overconfidence and lack of trust.
* Ofgem clause 4.12: failure analysis must cover loss of skills and over-reporting of good outcomes.
* Zentera (July 2026) argues model behaviour is the wrong base for an OT security control \[vendor].
**Standards**
* IEC 62443 has no AI part. The working approach is zones and conduits, with the agent as a new actor.
* NERC CIP has no AI standard.
* CIP-015-1, internal network security monitoring, was approved by FERC on 26 June 2025.
* CIP-015-1 took effect on 2 September 2025. Compliance is required by 1 October 2028. It sets no AI rules.
* The binding set is CIP-004, 005, 007, 010, 011 and 013. It captures agents by scope.
* EEMUA 191 Edition 4 (November 2024) sets the alarm, alert and prompt taxonomy. It has no AI content.
* The Highly Managed Alarm category, aligned with IEC 62682:2022, needs a defined proof-test method and frequency.
* The International Society of Automation has only floated AI for a future ISA-18.2 revision.
* In the risk hierarchy, alarms are administrative controls. Adding an agent does not change that.
* BP-Husky Toledo, 20 September 2022: 3,712 alarms in 12 hours, two deaths, about $597M in damage.
* The Chemical Safety Board's final report on BP-Husky Toledo came out in June 2024.
**Human factors**
* Decision support at about 85 percent accuracy or above cuts operator checking by 40 to 60 percent.
* That figure comes from the decision-support research literature.
* NERC (November 2024) warns against a mindset that treats people as hazards.
**Closed-loop control**
* Yokogawa FKDPP at ENEOS Materials: an 840-hour trial in January to February 2022 \[vendor].
* ENEOS adopted FKDPP permanently in March 2023. Steam and carbon dioxide fell 40 percent \[vendor].
* Aramco Fadhili acid gas removal unit: phased commissioning October 2024 to April 2025, announced October 2025 \[vendor].
* At Fadhili, amine and steam use fell 10 to 15 percent \[vendor].
* FKDPP runs at the plant's regulatory control level. The safety instrumented system is untouched.
* Honeywell Experion Cognition: announced 9 June 2026, live proof of concept at Borouge Ruwais \[vendor].
* Honeywell promised Cognition availability in Q3 2026. No confirmation was found.
* DataRobot and Chevron "Safe Start" agents for robotic inspection missions, 2 June 2026. Stage not stated \[vendor].
* Cognite and ABB agents built on ABB SafetyInsight and AlarmInsight, 21 May 2026. Aker BP is the first customer \[vendor].
**Economic result**
* eGridGPT converted node-breaker models to bus-branch planning models in under a minute.
* The converted case matched the EMS state estimation closely enough to satisfy NERC MOD-033.
* Standards for the asset data loop: ISO 55013:2024 and ISO 55001:2024 clause 7.6.
* EPRI puts about 95 percent of utility data behind security and privacy walls. It formed the Open Power AI Consortium in March 2025.
* FoSMo (National Grid, Keen AI, SPEN, SSEN-T, UKPN, ENWL) won GBP 355,985 from Ofgem's innovation fund in June 2026.
* FoSMo's claimed GBP 22.6M five-year benefit from 2027 is projected and unrealised \[vendor].
**Adoption survey**
* NERC survey, November 2024, 47 respondents, scored out of 5.
* Switching-order generation scored 1.08, the lowest of 17 use cases. Log entries scored 1.35.
* Compliance reports scored 1.41. Equipment-failure prediction scored 1.76.
* 30 percent had active bans on public AI tools. 88 percent rejected the job-loss fear.
* 72 percent saw open legal and ethical questions.
**Refusals and checks**
* Refused: circulating figures for an autonomous Ford manufacturing execution system. They trace to content farms.
* Refused as agent evidence: Equinor's reported AI savings. They come from traditional machine learning on about 700 rotating machines.
* Siemens Industrial Copilot writes IEC 61131-3 code in TIA Portal. It does not deploy on its own.
* No human-approval protocol is published for Siemens Industrial Copilot.
* AMLAS is the assurance method Ofgem points to, with ISO/IEC 23894, ISO/IEC 42001 and the NIST AI RMF.
* AMLAS was built for conventional machine learning, not language models.
* Re-verify: the joint guidance primary text, and ISA-18.2 revision status.
* Re-verify: CIP-015-1 compliance milestones (October 2028).
* Re-verify: the DESNZ independent review, with its final report due Summer 2026.
* Re-verify: whether Honeywell Experion Cognition became generally available.