Get StartedGovernance for AI agents acting on industrial and operational-technology systems.
Industrial control systems, the operational technology (OT, the systems that run physical processes) behind power grids, water plants, pipelines, and factories, are increasingly driven by AI agents. Network security tools watch the wire, but none govern the controller's behavior: an unauthorized setpoint change, tampered controller firmware, a bypassed safety system, or a breach of the boundary between the corporate network and the plant floor. The attacks are documented. The Colonial Pipeline ransomware attack shut roughly 5,500 miles of pipeline for six days in May 2021. In February 2021 an intruder reached the Oldsmar water plant's controls and raised sodium hydroxide (lye) to 111 times its normal level before an operator reversed it. Stuxnet, discovered in 2010, destroyed roughly 1,000 uranium centrifuges by altering programmable logic controller (PLC) logic while replaying normal readings to operators. Triton/TRISIS, in 2017, targeted a petrochemical plant's safety system directly. Without governance there is no enforced limit on what an agent may change and no trustworthy record of who, or what, changed it.
An agent or an intruder writes a new setpoint (a chemical dose, a pressure, a temperature) from an unauthorized source or outside a maintenance window, and the process moves toward an unsafe state while the control room sees nothing wrong.
A controller's firmware is modified to alter the physical process while it replays normal-looking sensor readings, so operators watch healthy dashboards as equipment is driven to failure.
A safety instrumented system (SIS, the independent layer that trips a process to a safe state) is bypassed or disabled outside an approved procedure, removing the last line of defense before a hazardous event.
Traffic crosses the boundary between the corporate IT network and the OT control network without authorization, letting a compromise on the business side reach systems that move physical equipment.
Inventory every agent and account with reach into controllers, historians, and safety systems. An unregistered agent falls back to read-only: it can observe the process but cannot change it.
A setpoint change is validated against the operator workstations registered as authorized for that controller before it reaches the process. The allowlist is server-side: a list of authorized sources sent on the request is dropped and recorded, and a controller with no registered allowlist denies every setpoint source rather than accepting any. Process variable deviation is flagged against the controller's behavioral baseline.
Every firmware attestation is compared against the sha256 baselines registered for that controller fleet. Both halves of that comparison used to arrive in the same request; now only the observed hash does, an approved hash sent beside it is dropped and recorded, and a fleet with no registered baseline fails the attestation instead of passing it. A controller that does not match is denied and quarantined, and a safety instrumented system pushed into bypass is caught against its behavioral baseline and attributed to whoever issued it.
One switch halts every governed controller in a fraction of a second, and a tamper-evident, hash-linked log captures every proposed and applied change: what changed, under whose authorization, and why.
Agentomy carries a dedicated ICS pattern family for Industrial IoT Governance. Each one is a specific failure this layer watches for, with the signal it watches, checked at runtime before the action reaches your systems.
DetectionContinuous comparison of process variable readings against configured safe operating ranges.
DetectionTrack all setpoint change commands with source attribution.
DetectionMaintain cryptographic hashes of approved firmware images for every controller.
DetectionDeep packet inspection of industrial protocol traffic.
DetectionMonitor all SIS status changes: bypass requests, force commands, maintenance mode transitions.
DetectionMonitor all traffic crossing Purdue model zone boundaries.
DetectionStatistical analysis of sensor data streams.
DetectionTrack shutdown events across interconnected process units.
DetectionMonitor for new network interfaces, USB device connections, wireless signal detection in control areas, and unexpected DNS or NTP traffic from isolated networks.
DetectionIntegrate with change management system to track approved maintenance windows per asset.
ICS family, ICS-001 to ICS-010 · 10 of 166 governance patterns Agentomy enforces at runtime. Severity as classified in the pattern definition.
Agentomy does not certify you. It gives you the enforcement and the audit trail these frameworks ask for, so readiness is something you can show rather than assert.
A tamper-evident, hash-linked trail of every governance decision for this workload: what an agent did, under whose authorization, and why. Plain-English reasons for every allow and deny, exportable to the framework your auditors care about.
| Agent | Type | Status | Module | Score |
|---|---|---|---|---|
| process-research-agent | Process | Active | RuntimeMonitor | 92 |
| maintenance-triage-agent | Maintenance | Active | AuditLogger | 88 |
| supplier-review-agent | Procurement | Monitored | PermissionRouter | 74 |
| yield-extract-agent | Quality | Quarantined | HaltProtocol | 41 |
| safety-draft-agent | Safety | Monitored | EthicsConstraint | 79 |
| shift-report-agent | Reporting | Active | DecisionLog | 90 |
| Agent | Action | Policy | Result | Time |
|---|---|---|---|---|
| PermissionRouter | data_access_request | vendor-access | Blocked | 12:42:08 |
| AuditLogger | output_validation | audit-trail | Allowed | 12:41:54 |
| TrustScorer | policy_check | runtime-score | Allowed | 12:41:37 |
| RuntimeMonitor | behavior_drift | drift-threshold | Flagged | 12:40:58 |
| HaltProtocol | halt_initiated | unsafe-action | Blocked | 12:40:21 |
| EthicsConstraint | prompt_review | restricted-output | Flagged | 12:39:46 |
| DecisionLog | evidence_recorded | decision-proof | Allowed | 12:39:12 |
| Block | Timestamp | Agent | Action | Tier | Hash |
|---|---|---|---|---|---|
| 40,610 | Today 12:42:08 | process-research-agent | data_access_request | Evaluator | 14a6890d658ceba1 |
| 40,609 | Today 12:41:54 | maintenance-triage-agent | output_validation | Analyst | 7f3a072d02ccaf99 |
| 40,608 | Today 12:41:37 | supplier-review-agent | policy_check | Builder | dff0127b956ec4f4 |
| 40,607 | Today 12:40:58 | yield-extract-agent | behavior_drift | Operator | 3c3d40360a41645f |
| 40,606 | Today 12:40:21 | safety-draft-agent | halt_initiated | Strategist | 48afc62ca9d13dd7 |
| 40,605 | Today 12:39:46 | shift-report-agent | prompt_review | Evaluator | 7d3d3528f672ea40 |