A plant does not lack data. The MES knows every station a unit passed, the ERP what shipped, the PLM what it should have been, the historian years of process values. What it lacks is a way to ask one question across all of them and act on the answer.
What a containment costs
What follows is an illustration, not an account of a deployment.
A torque tool drifts on line 2. Nobody notices for eleven hours: the controller checks it against a window widened during a March changeover and never narrowed back. On Thursday a customer plant rejects an assembly, and one question acquires a clock: which units are affected, and where are they now.
The answer exists in pieces. The MES holds the serials that passed that station, under the controller tag rather than the work centre code. The historian holds the torque traces, keyed by tag and joined to no serial. The ERP knows what shipped, under a different part number. Four identifiers for one part, and a join from serial to station to tag to time window nobody has made, so the plant convenes people and eight hours later there is a whiteboard number nobody can reproduce. Where that join cannot be made, the default is worst case: contain the whole suspect period, scrap good product.
Why an agent stops guessing
An agent turned loose on those schemas does not fail loudly: it guesses, and the guess reads as plausible. Ask for affected units and it joins the serial through a bridge table that also carries rework passes, multiplies rows, and returns a count forty percent too high. Nothing in the schema says a serial can traverse the same station twice, or that scrap here means dispositioned scrap and not the operator’s flag. That meaning lives in tag prefixes and in the quality engineer’s head.
Declare it and the guessing stops. A station pass becomes an object of its own, so the second pass on rework survives. One part carries the MES, ERP and PLM identifiers, with the precedence rule for a conflict written once. From there the agent traverses that graph in the plant’s own words, answers the containment question across four systems in minutes, and proposes the hold that follows. That is the useful shape of AI here: not drafted text, a scoped population with its evidence attached and an act to approve.
What we declare first
We start at the decision and work down to a column, never at the source schemas and up until a question falls out. Links get declared before properties, because almost all useful reasoning in a plant is a traversal and not a filter. And the ontology is an input, not an output: someone who knows the plant says which work centre code is the torque station, because a system that guesses will guess confidently.
Every write is staged
An agent that can act is only safe if it cannot execute. A proposed write opens under the permissions captured at proposal time, computes the diff of what would change, and holds until a person commits or rolls back.
Where it may write is settled first. The MES stays authoritative for what happened on the line; the containment set, the disposition and the hold are ours. Writability is default deny, and a managed copy is refused outright, because the next sync erases the write and nobody finds out.
Permissions live in the database, not the prompt, so an agent composing a query across a column it may not see takes a privilege error. The commit record goes in on the write’s own transaction, so a failed audit takes the write down with it; the execute and rollback records stay best effort by design.
Where this is the wrong tool
Nothing inside the control loop: no interlock, no safety path, nothing reaching into the control levels. And no model recovers a downtime reason keyed in from memory at end of shift: model what is measured, mark what a human asserted.
A plant already holds every fact its hardest questions need. They stay out of reach because nothing holds the meaning that connects them.