Securing Industrial AI Agents: Separating Command Proposals From Authorization

AI agents in industrial settings can read documents and call tools that affect physical operations, but generating a command does not confer permission to execute it. The article warns that retrieved content, such as maintenance logs or manuals, may contain malicious instructions that could push an agent beyond its scope. It argues that authorization must be enforced by trusted application components rather than relying on the model to ignore suspicious text. A proposed architecture separates an AI decision engine, an independent authorization gateway, and an action engine that executes only after checks pass. Approvals should be bound to the exact asset, action, parameters, identity, and expiration, so that changes between approval and execution are detected.