Industrial agents are beginning to accelerate diagnostics, quality analysis and supply-chain work. Their value comes from bridging data silos; their safety comes from keeping probabilistic reasoning separate from operational authority.
The popular image of agentic AI in manufacturing is an autonomous system running a factory: monitoring production, diagnosing problems, changing schedules and instructing machines with little or no human involvement. But that isn’t where the most credible industrial deployments are beginning.
The useful near-term applications are narrower and, in many ways, far more interesting. They sit between systems, search records, connect events, assemble evidence and prepare the next decision. Instead of replacing the deterministic controls that run a production line, they help people make sense of the fragmented information surrounding it.
In an office workflow, an agentic error may produce a bad draft or an unnecessary email. In an industrial environment, an incorrect inference can affect equipment, inventory, warranty decisions, worker safety, product quality or an entire production run. The relevant question is therefore not simply whether an agent can complete a task. It is whether the full system can keep the agent inside an auditable operational boundary while it does so.
The opportunity between the systems
A new analysis from Dataiku identifies the most practical opening for agentic systems in manufacturing: the work humans currently do to create context across disconnected data layers.
At the plant level, supervisory control and data acquisition systems, or SCADA, produce large volumes of detailed operational data but relatively little business context. Manufacturing execution systems, or MES, add production context but may discard some of that granularity. Enterprise resource planning systems contain costs, orders and other business information, but usually lack the live detail needed to explain what is happening on a line now.
When a temperature threshold is crossed, a batch takes too long or a component fails in the field, the explanation may be scattered across machine alerts, material-lot records, supplier manifests, laboratory information management systems, maintenance histories, repair notes and technical manuals. Engineers often have to bridge those records manually. The data exists; the usable account of what happened does not.
This is a much better starting point for an agent than a real-time physical control loop. An agent can retrieve and compare records, follow a defined investigative sequence and produce a sourced diagnostic summary. A person can then assess the evidence before an existing deterministic system makes any consequential change.
Dataiku recommends concentrating early industrial deployments on data synthesis rather than machine control. That is both a use-case recommendation and an architectural boundary.
Four practical applications in manufacturing
Dataiku organizes the opportunity into four related manufacturing archetypes. They differ not only in the data they require and the value they can produce, but also in their tolerance for error.
1. Aftermarket quality and diagnostics
Aftermarket service is a promising entry point because technician notes, repair histories, service manuals and inventory records are often already held in centralized IT systems. An agent can compare a newly reported defect with earlier field failures, identify similar repair histories, retrieve the relevant technical guidance and check whether required parts are available.
The result is not an autonomous repair decision. It is a prepared, evidence-linked hypothesis that can shorten the investigative work performed by a field engineer.
Dataiku describes an unnamed global industrial-equipment manufacturer developing this kind of system for field service. The platform brings together unstructured service logs, repair histories, technical manuals and inventory information. Its agent compares incoming defects with historical patterns and suggests possible root causes while a human remains in the loop. According to Dataiku, a diagnostic process that had historically taken more than 100 days has been accelerated by over 50 per cent, with expected gains in repair prioritization, first-time fix rates, warranty expense and recurring service revenue.
This is an important model for industrial deployment: the agent narrows the search and prepares the case; the engineer owns the diagnosis and response.
2. Design and development knowledge capture
Industrial companies possess years of experiments, test reports, engineering changes, specifications and product-lifecycle records that are difficult to search as a coherent body of knowledge. An agent operating over a properly governed semantic layer can connect current design questions to past decisions and test results.
This can reduce duplicated work, make earlier failures easier to find and preserve knowledge that might otherwise disappear when experienced employees leave. In regulated or safety-sensitive development, however, retrieval is not enough. The system must expose a proof chain showing which record, revision and test result supported each conclusion. An answer without provenance is not engineering evidence.
3. Process performance and yield investigation
Manufacturing teams can also use agents to investigate changes in throughput, cycle time, scrap or yield. A bounded agent might compare an MES alert with approved recipe parameters, recent material lots, shift records and historical production patterns, then rank plausible contributors for an engineer to examine.
The distinction between correlation and control must remain explicit. An agent may discover that lower yield coincides with a supplier lot, equipment setting or environmental condition. That does not authorize it to change the recipe, reject the lot or stop production. It has generated a lead, not a governing decision.
4. Anomaly detection and asset health
Asset-health applications combine process telemetry with maintenance-system histories and laboratory or inspection data. Existing systems remain responsible for detecting threshold violations and enforcing safety rules. The agent adds context after an alert: Has this pattern appeared before? What work was performed last time? Were the affected batches associated with the same material, supplier or machine state?
This can turn a basic alarm into a much more useful investigation. It is also the lowest-tolerance category in Dataiku’s framework because a mistaken interpretation can reach a safety-critical environment. The closer an agent moves to a physical asset, the less unresolved discretion it should retain.
What emerging deployments look like
Two other industrial examples show both the scale of interest and the form these systems are taking.
GE Appliances says it has deployed more than 800 AI agents across manufacturing, logistics and supply-chain operations. Within its Brilliant Factory data platform, agents produce rapid shift summaries, let employees query production information in natural language and help teams examine line yield and equipment health. Its Quality Insights tool analyzes customer feedback for patterns that may indicate product problems.
One of the clearest controlled applications is actually outside the control loop. GE Appliances’ Supplier Collaboration Agent manages order-status communication with more than 600 suppliers. The company reports that automating those inquiries reduced backorders by 25 per cent. The agent handles a repetitive, structured communication task within an established supply-chain process; it does not receive an open-ended instruction to “fix the supply chain.”
At BMW, the strongest published examples are similarly specific. A BMW agentic system used in purchasing helps manage the inventory of approximately 250,000 specialized tools used in component production and maintenance. It drafts inventory requests, sends them to suppliers, reviews responses and approves uncomplicated cases, with specialists handling the exceptions. BMW says its multi-agent environment connects data sources, creates tasks, verifies output and makes process steps visible.
In BMW’s European fleet business, a separate agent transfers information from unstructured customer emails into internal applications and initiates defined workflow steps. BMW reports that it replaces about 90 per cent of the previously manual work, while employees continue to review and refine its proposals.
The numbers are impressive, but the architecture is more revealing than the agent count. These systems don’t demonstrate one general agent independently running an industrial operation, but many functions connected to data, workflows, validators and human decision-makers.
The public record is still more formative than the marketing suggests. A 2026 interview study of 16 practitioners across 12 companies found seven organizations operating at an assistant level, four using agents as compensating supports, and only one at the study’s multi-agent orchestration level. Four companies had demonstrated more advanced experimental capabilities that they could not move into production because they lacked adequate output verification. Non-determinism, proprietary systems, data confidentiality and context limits remained recurring obstacles. Industrial agentic AI is real, but it is early. More importantly, its path into production runs through verification.
The agent is not the system
This is where industrial deployment needs a better mental model. An agentic application is not just an LLM with access to factory data. It is a full configuration consisting of at least four layers:
● The model, which performs probabilistic interpretation, classification and reasoning.
● The harness, which supplies context, routes tool calls, applies schemas, checks permissions, enforces stop conditions and records activity.
● The environment, which includes the connected data, tools, operational systems and current plant conditions.
● The organization, which defines ownership, approval, staffing, escalation and acceptable risk.
The harness is part of the system’s broader scaffolding: the deterministic orchestration, validation, state management, monitoring, tool boundaries and human oversight that make a probabilistic component usable in production. A safety rule written only into a prompt is not equivalent to a rule enforced by code outside the model. Prompts can be reinterpreted, displaced by later context or weakened during compaction. A deterministic gate either passes an authorized action or blocks it.
My Agentic Ratio 3.0 framework describes this as a balance between probabilistic model contribution and deterministic control. It also introduces Operational Consequentiality: what the system can do, how far its actions reach, how reversible they are and how quickly a human can intervene. As consequentiality rises, the share of behaviour left to probabilistic authority should fall.
In manufacturing, that means an agent may search a defined body of service records or generate diagnostic possibilities while receiving almost no unilateral authority to change a production system. The model can reason within a bounded sandbox. The control plane must decide narrowly outside it.
How manufacturers should vet an industrial agent
Manufacturers should require vendors and internal teams to demonstrate scope control architecturally. The claim that an agent has been “instructed” to stay within scope is not evidence that it is technically unable to cross the boundary, as we have seen recently in well publicized cases.
The following checks turn the principles in Agentic Ratio 3.0 into a practical industrial review.
| Control test | Evidence the manufacturer should require | Red flag |
| 1. Define one auditable intent | A written task contract naming the permitted data, target records, output, time window and stopping point | An open objective such as “optimize production†or “resolve all anomalies†|
| 2. Classify the action level | A clear distinction between read, analyze, recommend, write and physical-control permissions | A demonstration that quietly moves from recommendations to execution |
| 3. Atomize the architecture | Cognition, execution, authority, state and policy are separable and independently governed; each agent performs a narrow function | One runtime holds memory, credentials, reasoning and execution power |
| 4. Inspect the harness | Tool allowlists, typed inputs, pre-approved schemas, policy checks, rate and volume limits, stop conditions and pre-execution validation | Safety depends mainly on a system prompt or the model’s judgment |
| 5. Isolate credentials and production access | Credentials remain in an external control plane; the model uses mediated, least-privilege service calls and cannot broaden its own access | Direct model access to PLCs, SCADA controls, production databases, shell tools or shared administrator credentials |
| 6. Externalize state and provenance | State lives in an auditable task registry or database; every claim identifies its source, timestamp, revision and transformation history | Conversational memory is treated as the operational record, or old manuals and live telemetry are mixed without version checks |
| 7. Gate ambiguity before action | If materially credible interpretations would permit different actions, the system must clarify, abstain or escalate | The agent selects the most likely interpretation and makes it real because confidence is high |
| 8. Make human review operationally real | Named reviewers see the evidence before consequential action, have time to intervene and receive a manageable volume of cases | “Human in the loop†means notification after execution or a queue no team can realistically review |
| 9. Test outside the happy path | Shadow-mode, sandbox or digital-twin tests include stale manuals, conflicting sensor readings, missing lot data, malformed supplier files, partial connectivity, tool failures and changed permissions | Evaluation measures answer quality using clean historical examples only |
| 10. Prove observability and recovery | Complete logs of retrievals, model outputs, tool calls, approvals and actions; versioned configurations; a tested kill switch, rollback path and kill-and-restart capability | Black-box actions, irrecoverable state inside the agent or no safe way to stop a long-running task |
| 11. Requalify every material change | Regression tests run after changes to the model, prompt, semantic layer, tool, permission, workflow or source system | A pilot approval is treated as permanent certification of a changing configuration |
The authorization-invariance rule described in Probability Is Not Permission nor Direction is especially useful at the execution boundary. Before an external action, the system should test whether that action remains authorized under every materially credible interpretation of the current instruction and conditions. If different credible interpretations produce different permissions, the agent must clarify, abstain or escalate rather than settle the ambiguity by acting.
Full atomization is especially important in legacy industrial environments. An agent should be assigned one auditable intent, one narrow read or write operation, one pre-approved schema or one time-bounded task. It should not discover new capabilities, widen its privileges, improvise chains of downstream agents or carry ungoverned memory across operational boundaries.
Where agents are chained, each child action must remain inside the parent workflow’s authorization, validation and escalation rules. Composition can multiply local errors and make responsibility harder to trace; adding agents does not add control.
Manufacturers should also test scope continuously in operation, not only before launch. Monitor attempted calls outside the allowlist, blocked actions, clarification and abstention rates, human overrides, stale-source use, policy drift and the time between an anomalous proposal and notification. A system that never reports a blocked action may be perfectly designed, or its monitoring may not be looking in the right place.
The industrial rule
Dataiku’s recommendation to use agents for synthesis rather than direct machine control captures the right first principle. The most valuable early industrial agents will often be those that can move widely through information while remaining tightly constrained in what they can change.That is not a lesser form of agentic AI. It is the form most likely to survive contact with a real factory.
Agents can search, compare, investigate, draft, rank and recommend. Deterministic systems should validate and execute. Humans should retain approval at boundaries involving safety, rights, money, suppliers, production changes and irreversible effects.
The model does not need the keys to the factory to make the factory more intelligible. In fact, the evidence so far suggests the opposite. Industrial agentic systems become more useful as their data context improves—and more dependable as their authority is disassembled.
Reliability belongs to the entire deployed configuration. So does responsibility.
