INDUSTRY — INDUSTRIAL & OT · CRITICAL INFRASTRUCTURE
AI is reaching the control network. The control network cannot take a guess.
The Gateway's Edge/Autonomy profile implements deterministic action authorization and output conformance. OT boundary integration, deny behavior, and handoff to existing site safety controls are validated with each design partner during the pilot.
Bring one AI workflow, one consequential action, or one data boundary.
PLATE P-02 — CONTROL ROOM / PLANT FLOOR
FIG. 1 — THE IT/OT BOUNDARY, GOVERNED
IT SIDE
AI-ORIGINATED FLOW
copilot suggestion · agent action · operator prompt touching OT data
GATEWAY
CONTAINMENT
DETERMINISTIC RULING
fail-closed policy core · site-defined response contract · disconnected architecture
OT SIDE
CONTROL NETWORK
only ALLOW-ruled commands cross · denied or ambiguous commands do not cross · existing site safety logic remains authoritative
EXAMPLE — AN OUT-OF-ENVELOPE SETPOINT
A maintenance copilot drafts a setpoint change for pump P-114 and an agent proposes a PLC write. The policy returns DENY because the setpoint is outside the approved envelope. In a partner integration, the safe-state contract determines what the control system does next.
policy: ot-envelope-v9 · rule: setpoint_out_of_envelope · command denied · receipt sha256:2ba7…44c9 written
FIG. 2 — PROPERTIES THE PLANT FLOOR REQUIRES
Deny without bypass
Containment denies or quarantines commands that do not satisfy policy. The plant's existing SIS, PLC, and site-certified safety logic define the process response.
Deterministic under audit
The same input, policy, and context produce the same ruling — the property regulators and safety engineers can actually test.
Built for disconnection
No cloud round-trip in the decision path. Designed for DDIL, segmented, and air-gap-capable environments from the start.
VALIDATED PER PILOT — NOT CLAIMED IN ADVANCE
— Protocol integration (Modbus, OPC-UA, vendor stacks) — scoped with your team
— Decision-path latency on your hardware — measured, not brochure-quoted
— The fail-closed response contract — defined with your site
Numbers we haven't measured on your floor don't go in our marketing. They go in your pilot report.
FIG. 3 — THE FRAMEWORKS ON THE PLANT FLOOR
IEC 62443 — ZONES & CONDUITS
NERC CIP
NIST SP 800-82
The Gateway sits where 62443 puts the conduit: a governed crossing between zones. Designed to map — stated precisely on Compliance.
POWER & UTILITIES
WATER
OIL & GAS
MANUFACTURING
TRANSPORTATION
FIG. 4 — WHAT THE PLANT GETS
The business outcome: AI reaches the plant floor without betting the process on a guess.
AI adoption without an OT incident budget
Copilots and agents work against OT data with every proposed write ruled pre-execution. The plant gets the productivity; the control network never absorbs an unvetted command.
Uptime and safety, one requirement
Containment blocks a denied or ambiguous command from crossing the governed boundary. It does not replace the SIS, PLC, or site-certified safety logic that determines how the plant responds.
Evidence your assessors can test
Deterministic rulings and signed receipts give safety engineers and regulators something reproducible to review — the same input, policy, and context produce the same ruling, every time.
Managed pilot available — OT boundary, deny/hold behavior, and handoff to existing safety controls validated with your team.