No. An AI scheduling agent should not hold unrestricted MES write access. It should read a bounded, time-stamped operating snapshot, produce a narrow proposal with evidence, and pass that proposal through deterministic checks and accountable review before a scoped service writes anything to production.
That separation is the difference between a useful decision assistant and an automation path that can quietly amplify stale data, conflicting orders, or an overconfident model.
Why the last step is harder than the recommendation
Recent vendor demonstrations make the opportunity easy to see. At Automate 2026, held in Chicago on June 22–25, ARC Advisory Group reported on a Siemens demonstration that joined shop-floor systems, an orchestration layer, and AI agents around contextualized operating data. ARC published its account on July 1, 2026. The report is useful evidence of the architecture shown at the event, not proof of a production-wide performance result.
SAP made a related company announcement on April 20, 2026 for Hannover Messe, held April 20–24. SAP described a Production Planning and Operations Agent that validates material availability, capacity, and scheduling constraints, then offers alternatives for planners to review and approve. That is a product claim and availability statement—not independent evidence that every plant should automate the resulting transaction.
The design problem begins where the demo ends: a recommendation may be reasonable when generated and wrong by the time it is executed. A machine changes state. A quality hold appears. Another planner releases an order. A material lot is reassigned. The safe design must detect those changes before the write.
Use three planes: read, decide, act
The read plane builds a bounded snapshot from ERP, MES, quality, labor, and equipment status. It records object IDs, revisions, timestamps, units, and the source of each fact. This is where teams resolve the meaning conflicts exposed in our worked ERP/MES order exception.
The decision plane lets the agent compare options and generate a proposal. The proposal should name the order, requested change, reason, evidence snapshot, expected impact, and expiration time. It should not contain a reusable MES credential. This follows the same principle as an agent execution contract: constrain what the agent can ask the system to do.
The action plane is deterministic. A policy gateway rechecks identity, approved scope, material and capacity, conflicts, thresholds, and required human approval. Only then does a narrowly scoped transaction service attempt the MES write. The service uses an object version or equivalent concurrency check, an idempotency key, and a durable audit record.
Worked example: move one production order
The following is a fictional teaching example. A scheduling agent proposes moving production order P-104 from Line 2 to Line 3 after a machine alarm. Its evidence says material M-22 is available, Line 3 has a two-hour window, and the move could recover 70 minutes.
The gateway first verifies that P-104 is still at the same revision and has not entered production. It checks that M-22 is released for Line 3, that the alternative routing is approved, and that no newer quality hold or maintenance lock exists. Because the change could affect a customer promise, the policy routes it to the named production planner.
After approval, the transaction service writes only the authorized fields for P-104. If the MES object version changed during review, the write fails closed and returns the proposal for recalculation. A retry with the same idempotency key cannot create a second move. The audit record connects the source snapshot, agent proposal, policy result, approver, write response, and later reconciliation.
What this design does not solve
A controlled gateway does not make poor master data accurate, a weak scheduling objective useful, or an untested interface reliable. It also does not remove the need for rollback and recovery. Plants should begin with recommendation-only operation, replay historical exceptions, test rejected and stale proposals, and measure how often humans revise the recommendation before enabling any write path.
ISA-95 is relevant because it separates enterprise and manufacturing operations concerns and defines models and transactions for their exchange. But the standard is a foundation, not a site-specific permission policy. Your object model, validation rules, safety constraints, segregation of duties, and recovery procedures still need explicit engineering.
Three takeaways
- Keep agent credentials out of the action plane. The agent proposes; a scoped service writes.
- Recheck facts at execution time. A time-stamped proposal is not proof that the plant state is unchanged.
- Design rejection and recovery first. Stale versions, missing approvals, duplicate requests, and failed reconciliation should stop or reverse the action predictably.
Sources
- ARC Advisory Group, “From Data to Decisions: Siemens’ Vision for Industrial AI at Automate 2026”, July 1, 2026; event June 22–25, 2026.
- SAP News, “SAP at Hannover Messe 2026: Operationalizing Agentic AI…”, April 20, 2026; event April 20–24, 2026. Company announcement.
- International Society of Automation, ISA-95: Enterprise-Control System Integration, official overview accessed October 6, 2026.
Next action
Before connecting an agent to production, list one proposed MES transaction and identify its read sources, allowed fields, deterministic checks, approval owner, idempotency rule, and reconciliation step.
Leave a Reply