Arge Bilişim
tren
Arrows leaving a neural network, stopped by slices with holes in different places

Trusting AI in the factory: access, approval, logs

@rgemas · · 5 min read

When AI comes up in a factory, the first question is usually: “What happens if it opens the wrong work order, or shows cost data to someone who shouldn't see it?” It is a fair question. AI models work on probabilities and may not give the same answer to the same question every time.

The most structured answers come from the teams putting AI agents into production in software, and from security agencies. The principles below were written for software agents. In each section we look at what they mean in a factory, and how argemas applies them in its AI layers.

One safeguard is never enough

Boris Cherny, who created Claude Code at Anthropic, says there is no single perfect answer for safety and security, and sums up the approach like this:

…it's always a Swiss cheese model. You just need a bunch of layers.

Every slice has holes. As long as the holes don't line up, the slices together stop the threat. Thariq Shihipar, from the same team, describes the approach as “the Swiss cheese defense”: separate safeguards at the model layer, in the environment the agent runs in, and at its access boundaries.

In guidance published on 2 June 2026 with Carnegie Mellon University's SEI, the US National Security Agency (NSA) examines the Model Context Protocol (MCP), the standard that connects AI agents to software tools. After listing the risks specific to agents, it reaches the same conclusion:

These should not be viewed as isolated problems that can be patched at the interface or endpoint level.

In a factory, that means access, approval and logging are built as separate layers, each catching what the others miss.

Access: AI reaches only the data it is allowed to

One of the NSA's recommendations is the principle of least privilege:

MCP agent processes themselves should follow the principle of least privilege

On the shop floor, this means the AI sees only the data its task needs. Cost data a shift supervisor cannot see stays closed to the AI working on that supervisor's behalf.

In the argemas AI Integration Layer, the AI reaches only the data the company permits, for the person permitted. Access rights are set per department and per person. Requests are blocked at three points: before the query, at the database and on the way back. An air-gapped deployment is also an option.

Approval: read first, write with human approval

There is a big difference between AI making a recommendation and AI taking an action. Opening a work order, raising a maintenance request or changing the production plan all have consequences on the floor.

In the argemas AI Layer, only authorised roles can start such actions, and only through the configured approval path. Users can inspect the evidence behind each recommendation. In the integration layer, the AI is read-only first; writes go only to separate tables, and only with human approval.

That is also a sensible order for a factory that is just starting: recommendations first, approved actions later.

Logging: what was asked and what was done must be visible

At Anthropic's Code with Claude event, Jess Yan and Lance Martin shared a finding from their own user research. A majority of their users said that:

…their agents are running with no formal observability.

The NSA guidance is even more explicit about logging:

All tool and model invocations should be logged, including the exact parameters, identities involved, and (where feasible) cryptographic hashes of results or output.

In a factory, this means the question “Why did the AI recommend this, which data did it look at, and who approved it?” always has an answer. The argemas integration layer logs intent and executed code for every user. In the AI Layer, critical operations are governed by role-based authorisation, configured approval steps and traceable transaction records. The traceability of cited evidence and the share of recommendations users approve are among the measures it tracks.

Trust is granted once and checked regularly

The NSA guidance points to one more risk: the permissions of a connection you already trust can change quietly.

…a change in capability or data access for an MCP server that is already trusted or connected often can be made without approval.

On the shop floor, that means knowing who approved each new data source and each new permission connected to the AI. In the argemas AI Layer, a new source is added together with its permission definition. Whichever AI solution you use, ask for answers to these questions regularly:

  • Which data can the AI reach today, and what changed since last month?
  • Which actions can it take without approval?
  • How many recommendations were approved in the last month, and how many rejected?

Starting with one decision

One decision is enough to start. The argemas AI Layer works from one principle: define the decision before selecting the model. You choose one measurable decision or workflow, identify its data sources, and define the approval boundary and the measure of success. The access, approval and logging layers are then built around that decision.

For details, see our AI Layer and AI Integration Layer pages.

Sources

Share this post

XLinkedInWhatsApp
All posts