Your MES renewal quote this year almost certainly has a new line item on it. It’s called a copilot, or an agent, or “autonomous ops,” depending on which vendor’s marketing team got there first. The pitch is consistent across all of them: an AI that doesn’t just surface insight, it acts. It writes the work instruction. It suggests, then applies, a reason code. It notices a drift and adjusts a setpoint. It closes a quality hold. Somewhere in the demo, a human clicking “approve” quietly disappears from the workflow, and nobody in the room seems to mind, because the demo always works.
The problem is that “agentic” has become a marketing category before it became an engineering one. It gets used to describe everything from a chatbot that drafts a document for a person to review, to a system with standing write-access into your MES that can change what happens on the floor without anyone in the loop. Those are wildly different risk profiles wearing the same label. If you’re signing off on write-access scopes this renewal cycle without separating them, you’re not managing risk, you’re just hoping the vendor did.
Start with what the agent can touch, not what it can say
Every agentic AI feature has two separate capabilities that vendors love to blur together: what it can generate, and what it can execute. An agent that drafts a corrective action narrative is doing natural-language generation against your historical data. An agent that closes that corrective action, updates the disposition in your quality system, and releases held WIP is doing something categorically different — it’s exercising write authority inside a system of record that feeds traceability, genealogy, and in regulated industries, your audit trail to the FDA or your customer’s PPAP file.
The demo shows you the first thing. The contract, if you’re not careful, grants the second. That gap is where the real decision-making needs to happen, and it’s almost never spelled out clearly in the sales deck. You have to go find it in the API scope, the role permissions, and the actual data flow diagram — not the slide with the friendly robot icon on it.
The low-risk tier: safe to turn on now
A useful way to sort this is by what happens if the agent is simply wrong, and how far that wrongness can travel before a person notices.
Drafting and suggestion, with a human still in the write path
Letting an LLM draft a standard operating procedure from an engineer’s rough notes, existing SOPs, and equipment documentation is genuinely low-risk, because the output sits in a review queue until a qualified person approves it. The same goes for suggested reason codes on downtime events, suggested root-cause categories on scrap, or auto-summarized shift handover notes. In every one of these cases, the agent’s mistake is a bad first draft, not a bad outcome on the floor. A reviewer catches it before it becomes data anyone acts on.
Anomaly flagging and pattern surfacing
Agents that watch SPC data, historian trends, or OEE waterfalls and flag “this looks like the drift pattern that preceded the last three unplanned stops” are doing exactly what statistical process control and condition monitoring have always tried to do, just with better pattern-matching than a control chart rule set. Flagging isn’t acting. As long as the output is a notification, not a command sent to a PLC or a hold placed on inventory, the downside of a false positive is an engineer spending ten minutes looking at a chart that turned out fine.
Read-only synthesis across systems
Agents that query your MES, ERP, and historian to answer “why was line 3 slower than line 2 last shift” and hand back a coherent answer are valuable and safe, provided the connector is genuinely read-only. This is worth verifying technically, not just contractually, because a poorly scoped API credential can have write permissions nobody asked for sitting unused until something calls them.
The higher-risk tier: keep the human in the loop, for now
Auto-adjusting setpoints or process parameters
This is where agentic AI starts touching the control layer, and it deserves the same scrutiny you’d apply to any change to a validated process. If an agent can nudge a temperature, speed, or pressure setpoint based on its own inference, you’ve effectively let a system make an engineering change decision without an engineering change record. Even if the model is right most of the time, “most of the time” isn’t the bar for anything that affects product conformance. The mechanism that matters here is the same one that’s always mattered in process control: closed-loop automation is fine when the control logic is validated, deterministic, and within a known operating envelope. An LLM-derived recommendation is neither deterministic nor easily auditable after the fact in the same way a PID loop is. Keep a person approving the change until the industry has better tooling for validating and version-controlling model-driven setpoint changes the way we validate PLC logic.
Closing quality holds or dispositioning nonconformances
A quality hold exists precisely because something needs a qualified human judgment call — is this defect cosmetic or functional, does this deviation require customer notification, does this lot need containment. Letting an agent close that loop autonomously collapses a control that exists for good reason, often a regulatory one. This is one of the clearest lines to hold: agentic AI can build the disposition packet, pull the relevant specs, and draft the recommendation. It should not be the signature.
Releasing WIP or triggering material movement
Autonomous release of work-in-process, especially across a hold or inspection gate, means the agent is making a genealogy and traceability decision that downstream consumers of that data will treat as ground truth. If it’s wrong, the error doesn’t stay local — it propagates into every record downstream, and unwinding it after the fact (recalls, containment, customer notifications) is a lot more expensive than the minute a supervisor would have spent clicking approve.
A validation checklist before you sign the scope
- Ask for the exact API permissions the agent’s service account holds in your environment — not a description, the actual role/permission list. If it has write access to tables it doesn’t need for its stated function, that’s a scope to shrink before go-live.
- Ask what happens when the model is uncertain. A well-designed agent should have a confidence threshold that routes low-confidence cases to a human. If the vendor can’t describe that threshold and how it’s tuned, assume there isn’t one.
- Ask for an audit log of every autonomous action, separate from human-initiated ones, with the model version and input context that triggered it. If corrective actions or setpoint changes made by the agent aren’t distinguishable in your records from ones made by a person, you have a traceability gap regulators and customers will eventually ask about.
- Test the failure mode, not the happy path. Feed the agent a scenario your operators would recognize as ambiguous or edge-case, and see whether it defers or guesses. The demo will never show you this voluntarily.
- Map the blast radius. For every autonomous action the agent can take, ask how far the consequence travels before a human sees it — one workstation, one line, or into ERP, customer records, and regulatory filings.
- Confirm reversibility. Can the action be rolled back cleanly, or does it need to be corrected downstream by hand? Irreversible actions deserve a human trigger almost by definition.
Where this settles, at least for now
The honest read is that agentic AI is genuinely useful in MES today, just not for the part of the pitch that gets the most stage time. The drafting, summarizing, and flagging work is real productivity gain with contained downside, and there’s no good reason to wait on it. The closed-loop, autonomous-action layer — setpoints, holds, WIP release — is a different engineering maturity problem, closer to how the industry approached safety-rated automation than how it approached reporting dashboards. It’ll get there. IEC 62443-style security zoning and better model auditability will eventually make some of this safe to hand over. But “eventually” isn’t this renewal cycle, and the vendor asking for the write-access scope right now isn’t the one who inherits the consequences if the boundary gets drawn in the wrong place.
The practical move isn’t refusing agentic features. It’s insisting the contract and the permission set match the risk tier you’ve actually decided you’re comfortable with — not the one the demo made you feel comfortable with in the room.
This article was written with the assistance of artificial intelligence. While we aim for accuracy, the information may be incomplete, out of date, or incorrect, and should be independently verified before you rely on it for any decision. It is provided for general information only and does not constitute professional advice.
