One Off-Switch for Every Vendor's Agents on the Factory Floor

Agents from several vendors are already acting on the factory, each governed by its own console and its own rules. There is no single view of what they are doing and no single way to stop them.

• Each vendor governs only itself. Per-tool controls cannot see or stop another vendor's agent.
• Interactions are nobody's responsibility. One agent's action becomes another's input, and no console shows the chain.
• Stopping everything means stopping each thing. In an incident, the operator works console by console.

Four vendors' agents already act on the plant, and they keep acting. What changes is that every action lands in one record, under one rulebook, behind one stop.

• One view across every agent, whoever built it. Actions from all vendors land in a single record.
• One rulebook applied to all of them. What each agent may touch is set once and enforced uniformly.
• One control that stops everything. A single off-switch that holds all agent action, without logging into each vendor's console.
• Risky moves held regardless of origin. The rule attaches to the action, not to the tool that proposed it.

The rule attaches to the action, not to the tool that proposed it. That is the difference between governing an estate of agents and configuring each of them separately while hoping the settings agree.

• The boundary is written once. What may be touched, what needs a person, and what is never permitted, defined per system of record and per action type rather than once per vendor in a different console.
• It is enforced beneath the agents. Every agent clears the same checkpoint on the way to your systems, so a vendor's own permissive default cannot widen what its agent is allowed to do here.
• Interactions become visible. One agent's action is another's input. A chain no single console can show is exactly what a shared record exists for, and it is where the surprising failures live.
• A new agent inherits the rules. The next tool the plant buys arrives inside the same boundary on day one, rather than starting life as another separately-governed island to be reconciled later.

A stop that requires four logins is not a stop. In an incident the number that matters is the time between deciding to halt and everything actually being halted.

• Pause one agent, or all of them. From one place, without opening each vendor's console. Scope can be narrowed to a system, a site or an action class rather than being all or nothing.
• Held, not silently dropped. Stopped actions are recorded with their originating vendor and the reason, so restarting is a decision made against a list rather than a hope that nothing was lost in the halt.
• The state it leaves behind is defined. What happens to work already in flight is agreed per system of record before go-live, because an incident does not leave time to answer that question well.
• The record spans the estate. One incident review reads one record. Reconciling several consoles after the fact is how the interaction that caused the incident stays invisible until it happens again.

Any vendor selling floor agents can only ever govern its own.

One view and one stop across the estate has to come from a layer that competes with none of them.

This is a 60 to 90 day proof of concept on a single line, cell, category or product family. The figures below are what the proof of concept measures against a baseline captured in its first two weeks. They are targets and instrumentation, not results already delivered.

• Risky actions caught before the floor. Counted across both agent groups in the proof of concept, with the originating vendor recorded.
• One record spanning vendors. Designed so an incident review does not require reconciling several consoles.
• Time to stop all agent action. Measured, because in an incident it is the number that matters.