AI Agents in OT: Governance Controls Proposed by a Summit Panel

On October 1, 2026, IIoT World published a summary of a panel at the Industrial AI Summit 2026 on how to govern AI agents in OT systems. The panelists were Scott Christensen (GrayMatter), Gary Tillery (Skkynet) and Ian Bramson (Black & Veatch), with Matt Morris of EverLine moderating. Two caveats: the article is sponsored by Skkynet, although it is labeled editorially independent, and AI tools were used to produce the summary. It contains no new data or statistics: the recommendations are practitioners' opinions, not a standard.

The problem: one agent per vendor

A plant with 20 or more vendors may face one AI agent from each, every one with its own access model and integrations. Because OT systems are tightly interconnected, a change made by one agent can ripple through downstream systems. In addition, every data egress path to dashboards, analytics or AI is a potential attack surface. The panel's advice is to govern all of these paths and leave no ungoverned channels.

The proposed controls

The measures the panel discussed are the following.

• Unique identity: each agent has its own credentials, like a human user. Without them, forensic analysis cannot determine which agent made a change.
• Audit trail: record who initiated the action, what permissions the agent held, what data informed the decision, how it was executed and with what outcome. The data chain must be traceable end to end. An AI may recommend a setpoint, but the log must show where it was executed and who or what authorized it.
• Access management: role-based access control with least-privilege permissions, credentials held in a vault, network segmentation and continuous monitoring, just as for people.
• Zero trust: no agent is trusted on any network, every action requires justification, and containment should limit the impact to the agent's own segment.

A few simple principles

According to the panel, no single framework covers both OT security and AI agents. They suggest combining IEC 62443 with AI-specific principles, distilled into 5 to 10 simple rules. Examples cited:

• least privilege for every agent;
• no autonomous agents at Purdue model level 0;
• mandatory identity and access tracing for every agent action;
• consequence assessment before go-live;
• data flow analysis before introducing AI.

The panel also noted that regulated sectors, especially in Europe, face more prescriptive requirements.

Three questions for Monday morning

The speakers proposed questions that managers can ask right away.

• Tillery: if connectivity were lost, what would keep running, and who decided that?
• Christensen: do we have a backup of the process, meaning configurations and ladder logic, and not just of the data?
• Bramson: where is the AI risk register for OT, and who owns each risk?

Why it matters

Agentic AI is arriving in plants through vendors, with or without formal controls. For engineering and IT leaders, the value of this contribution lies in its practicality: treat agents as users with identities, permissions and traceable accountability, and verify every data flow before adding a new one. Since this is a panel summary and not a standard, the advice should be adapted to your own context, but it offers a concrete starting point for taking an inventory of the agents already present and defining a small set of internal rules.