Heavy industry is being sold autonomy as a product: install the platform, connect the data, and the plant begins to run itself. Plants that have tried it know how that story ends, with a pilot that impressed everyone and changed nothing. The reason is not model quality. It is that autonomy is not a capability you install; it is authority you delegate, and industrial organisations have no machinery for delegating authority to an algorithm: no policy that says which decisions it may take, no escalation path when it is uncertain, no audit trail when it is wrong, no answer to who is accountable at 2 a.m. This article treats autonomy as what it actually is, an operating model design problem, and lays out the working parts: a decision inventory, a graduated trust ladder, a policy engine with explicit bounds, evidence standards for promotion between levels, and the accountability and skills structures that keep the system honest for the decades a plant lives.
Why Autonomy Projects Stall: The Module Fallacy
The pattern repeats across steel, cement, chemicals, and mining. A capable AI system is deployed. Its recommendations are good, measurably better than the status quo on the metrics everyone agreed to. Eighteen months later, operators are still running the plant exactly as before, the recommendations land in a queue nobody owns, and the program is quietly reclassified from transformation to tooling.
The post-mortems blame change management, which is true in the way that blaming weather is true. The structural cause sits deeper. A plant is a web of delegated authority refined over a century: the operator may adjust within the envelope, the shift supervisor may cross it, the production manager may trade output against maintenance windows, and every boundary is written down somewhere, in standard operating procedures, in interlock logic, in the alarm philosophy, in who signs which permit. When an algorithm arrives, it holds a position in this web that no document defines. So the organisation defaults to the only safe answer: the algorithm advises, a human decides, every time, forever. That default feels prudent and is in fact a decision to cap the value of the system at the capacity of the humans reviewing it. Advisory-only autonomy saturates quickly: the reviewing engineers become the bottleneck, review quality decays into rubber-stamping or reflexive dismissal, and both failure modes are invisible in the KPI deck.
The module fallacy has a mirror image that is equally damaging: the vendor demo that leaps straight to closed loop, letting the model write setpoints on day one. Operations rightly refuses it, the refusal hardens into policy, and the plant is back at advisory-only with scar tissue. Both failures share one root. Nobody designed the middle, the graduated structure by which an organisation extends trust to any new decision-maker, human or otherwise. We do not give a new engineer the keys to the plant on day one, and we do not keep them in shadow mode for ten years either. We have an operating model for growing human authority. Autonomy needs the same thing, engineered with the same seriousness as the control system itself.
The Framework: Decisions, Not Use Cases
The design begins by changing the unit of analysis. Not use cases, not assets, not models: decisions.
First, the decision inventory. Enumerate the recurring operational decisions in scope: raise or lower a setpoint within the quality envelope, re-sequence the next three heats, de-rate a degrading asset, release a maintenance work order, shed load to the spare. For each, record what the organization already knows but has never written in one place: who decides today, on what information, within what bounds, reversible or not, at what consequence if wrong, and how often it recurs. This inventory is the single most clarifying artifact in any autonomy program, because it converts “AI transformation” into a finite list of delegations, each of which can be reasoned about, bounded, and audited. It also reveals the real distribution of opportunity: most plants discover that a small set of high-frequency, low-consequence, fully reversible decisions produces the bulk of the value, and that these are precisely the decisions nobody senior is attached to.
Second, the trust ladder. (Figure 1.) Every decision class is assigned an autonomy level, and the levels are defined by authority, not by technology. Level zero: the system observes and learns; its outputs are compared against human decisions silently. Level one: advisory; the system recommends with evidence and a stated confidence; the human decides, and critically, the human’s acceptance or override is logged with a reason. Level two: approval-gated; the system prepares the complete action, a validated work package, a drafted setpoint change, and a human approves with one act; the default is now the system’s judgment, and the human exercises exception authority. Level three: bounded autonomy; the system acts without per-action approval inside hard envelopes, rate limits, and quality constraints, with every action logged and reversible, and anything outside the envelope escalating to a human. Level four: closed-loop; reserved for decision classes where reversibility is high, consequence is characterised, and the evidence file is long. A plant is not at one level; it runs a portfolio, with drying-fan setpoints at level three while ladle scheduling sits at level one, and that heterogeneity is the design, not a compromise.
Third, the policy engine and the promotion standard. (Figure 2.) The rules that govern each decision class, bounds, escalation triggers, approval authorities, override rights, must live as explicit, versioned policy, not as tribal knowledge or vendor configuration. And promotion between levels must be earned on evidence, the way the organisation already qualifies people and equipment: a defined observation period, a measured agreement rate against human decisions, a counted and investigated set of disagreements (some of which, examined honestly, turn out to be the human’s error), and sign-off by the same authority structure that owns the standard operating procedures. Demotion must be symmetric and unremarkable: a decision class that misbehaves drops a level pending investigation, exactly as a tripped protection relay is investigated, without the program being declared a failure. The alarm-philosophy discipline the industry already practices, every alarm justified, prioritised, and periodically rationalised, is the correct mental model; autonomy policy is alarm philosophy for actions instead of annunciations.
The Deployment Blueprint: The Parts Everyone Skips
Accountability must be redesigned, not assumed. At level two and above, the honest question is: when the system acts within policy, and the outcome is bad, who answers? The workable pattern assigns accountability to the policy owner, not the algorithm and not the operator: the named engineer or manager who set the envelope answers for the envelope, the system answers for staying inside it (provable from logs), and the operator answers for the overrides they take. Write this down before the first level-two promotion. Organisations that leave it implicit discover it during an incident investigation, which is the most expensive possible classroom.
Overrides are the richest data in the program. Every human override of the system, and every system escalation to a human, is a labelled disagreement between two decision-makers. Reviewed weekly, these become the engine of improvement: model gaps, policy bounds set too tight or too loose, and operator knowledge the sensors cannot see, each visible and actionable. A plant that merely counts its override rate has a metric; a plant that investigates every override has a learning system. The target is not zero overrides, which indicates rubber-stamping, nor a high rate, which indicates mistrust or a bad model, but a stable, explained rate that falls slowly as policies mature.
Skills must be rebuilt one level up. The operator whose routine adjustments are automated does not become redundant; they become the supervisor of a portfolio of automated decisions, and that is a different job requiring explicit training: reading the system’s evidence, judging when to override, running the degraded-mode procedures when the autonomy layer is unavailable. Degraded-mode competence is the part everyone skips. A plant that can no longer run itself manually for a shift has not automated its operations; it has made them hostage. Preserve manual proficiency the way the industry preserves fire-drill proficiency: scheduled, practised, audited.
Start where the inventory says, not where the demo shines. The first promotion to bounded autonomy should be a decision class that is high-frequency, low-consequence, fully reversible, and instrumented well enough that success is provable in one quarter. The purpose of the first case is not its own ROI; it is to force the organization to build the ladder, the policy engine, the logs, and the review rhythm, on a decision nobody fears. The machinery, once built, is what scales. The twentieth decision class promotes in a week because the first one took six months.
Follow this discipline for a few years and the plant acquires something no retrofit of dashboards ever produces: a complete, versioned, auditable record of how it makes operating decisions, who or what holds which authority, on what evidence, with what results. That artifact compounds. New regulations on AI in safety-adjacent industrial use, already forming in several jurisdictions, will demand exactly this record, and plants that have it will certify while competitors scramble. Insurers and acquirers will price it, for the same reason they price a mature process-safety management system. And the plant’s own engineers inherit a decision architecture they can extend, rather than a pile of vendor configurations nobody dares touch. The autonomous plant, when it arrives, will not be the one with the most models. It will be the one that can explain, for every action taken on its iron, why, by whose authority, and on what evidence. That is an operating model. No module ships it.
Stop buying autonomy as software and start designing it as delegation. Build the decision inventory first; it converts transformation into a finite, reasoned list. Define the trust ladder by authority, not technology, and run a portfolio of levels rather than a single posture. Make promotion between levels an evidence-based qualification with symmetric demotion, owned by the same structures that own your operating procedures. Assign accountability to policy owners before the first promotion, treat every override as data, and train the degraded mode as seriously as the automated one. The plants that do this will not look dramatically different in year one. By year five they will hold an asset their competitors cannot buy at any price: an operating model that earns, verifies, and compounds trust between people and machines.
