On this page
Control plane and data remain inside the plant's own jurisdiction.
Pilot on one line: baseline, watch-only, local enforcement, readout.
Local limits bind a tool configured at headquarters.
Challenge
Headquarters signs a global AI agreement and hands the tool to a plant to run against local data, under rules written elsewhere. When it makes a bad call on a reschedule or a hold, the scrap and the missed ship date land on the plant.
- The tool has no knowledge of this line. It has not seen the site's yields, its constraints or its failure modes.
- The data may not legally leave. Residency requirements can prohibit the transfer the tool assumes.
- Accountability and control are separated. The plant carries the consequence of decisions it did not configure and cannot inspect.
The same four things, and where each one runs
Configured at headquarters
Running on the floor
The plant's data
The plant's data
Transferred to wherever the tool lives
Inside the site's own jurisdiction
The model
The model
Has never seen this line's yields
Runs where the line is, location pinned and documented
The limits on what it may do
The limits on what it may do
Set centrally, unchangeable locally
Local limits bind the central configuration
The consequence of a wrong call
The consequence of a wrong call
Carried by the plant
Carried by the plant
Solution
The tool headquarters bought can still run. It runs on the plant's floor, inside the country, against data that never leaves it.
- The runtime sits inside the country and the plant. Control plane and storage run in the local environment, so data does not cross the border.
- Local rules bind the global tool. The plant sets what the agent may touch, and those limits hold regardless of the HQ configuration.
- Site conditions checked before action. Local constraints are verified before a global recommendation is allowed to act.
- A record the plant owns. Every action logged locally, readable by the people accountable for it.
What Runs Where
A residency rule that depends on every engineer remembering it at 2am is not a control. The deployment shape is what makes the answer the same on every shift.
- Control plane and storage, in the plant's jurisdiction. They run inside the site's own environment, its national-cloud tenancy, or on hardware at the plant itself. Not a tenancy on infrastructure in another country with a contractual promise attached.
- Inference location, pinned and documented. Where a model runs is a stated fact about the deployment rather than a routing decision taken per request. The auditor's question is where, not roughly where.
- Egress, allowlisted in the kernel. Outbound paths are enforced beneath the workload, so a tool configured at headquarters cannot open a route the site never approved. Not a policy saying data will not leave, an architecture in which it cannot.
- Isolation per run. Each run executes in its own micro-VM with its own guest kernel, so the blast radius of a bad call is the run rather than the plant's systems.
- The classification is decided once. What must stay on the floor, what may leave the country, and what an outside model may ever see is set as a rule and enforced automatically, not judged case by case under time pressure.
Who Answers for a Call Nobody Local Configured
The contract is signed above the plant. The scrap, the expedite freight and the missed ship date are not. That gap is an authority problem before it is a technical one, and it is the reason the local team resists a tool that would otherwise help them.
What headquarters keeps
- The platform and the agreement. The maintenance, planning or quality agent HQ contracted keeps running, and nothing about the global agreement has to be reopened.
- The group view. Central reporting still receives what it received, subject to the classification rule the site has set once.
What the plant gains
- A veto on the live plan. Before an agent changes the schedule, order or work order the plant actually runs on, that change clears local rules and, where the plant chooses, a local person.
- Local constraints that outrank a global default. The site's yields, changeover rules and failure modes are checked before a recommendation written elsewhere is allowed to act on them.
- A record it owns. Every action, and where the data went, produced locally for the plant's own risk committee rather than requested from a vendor after the fact.
Outcome Derived
This is a 60 to 90 day pilot on a single line, cell, category or product family. The figures below are what the pilot measures against a baseline captured in its first two weeks. They are targets and instrumentation, not results already delivered.
- Data crossing the border. Structurally prevented by where the runtime is deployed, rather than governed by policy alone.
- Local override on global actions. The plant can stop or scope any agent action, and each intervention is recorded.
- Pilot measured on the plant's own numbers. Scrap, expedite and schedule adherence against the site's baseline, not a global average.
Highlights
- The runtime installs in the plant's own environment, a national-cloud tenancy, or on plant-floor hardware, so the tool headquarters bought runs where the line is.
- Residency stops being a policy and becomes a property of where the software runs. There is no border crossing left to govern.
- The plant sets what an agent may touch, and those limits hold over the configuration written at headquarters.
- Where inference happens is pinned and documented, because a national programme review or a customer audit will ask.
- The action record stays in-country and is readable by the people who carry the consequence of the action.
Frequently asked questions
Do we have to give up the AI headquarters bought?
No. It keeps running. What changes is where it runs and what it may commit. The runtime sits inside the plant's environment or in-country, and any change to the live schedule, order or work order clears the site's rules before it takes effect.
Will plant data leave the country?
Not unless the site decides a specific flow may. Control plane and storage run inside the plant's jurisdiction and outbound paths are allowlisted in the kernel, so the transfer a global tool assumes does not exist as a route. Where inference happens is pinned and documented for the auditor who asks.
What if headquarters and the plant disagree about a limit?
Local limits are enforced where the agent cannot reach them, so they hold over the headquarters configuration. That is deliberate. The site carries the scrap and the missed ship date, so the site sets what may touch its line. Headquarters keeps the platform, the agreement and its group view. What the plant gains is a veto on the plan the line actually runs to.
How does the pilot start without risking the line?
One line, watch-only for the first weeks. The agent produces every call it would make and nothing acts, so the plant judges it against its own yields and constraints before local enforcement is switched on. The first record of what it did, and where data went, arrives in that phase.
