An AI agent is asked to inspect a transformer at a substation.
It can read the asset’s maintenance history, examine sensor data and review recent imagery. It identifies a possible vegetation clearance issue and recommends an inspection.
So far, the workflow sounds useful.
But what happens if the same agent can also dispatch a drone, create a work order or change an operating setting?
Each action carries a different consequence. Yet many AI deployments begin with a simpler question: Does the agent have access to the system?
As AI moves from answering questions to coordinating work in physical environments, that question will no longer be enough.
We also need to ask:
What is this agent authorized to do, to which asset, in which location, under what conditions, and for how long?
My view is that Physical AI may need a digital equivalent of the work permit.
The gap between access and authority
Enterprises are beginning to recognize that AI agents need their own identities and carefully controlled permissions.
On 19 October, Microsoft described an approach to agent security that includes dynamic risk assessment, permissions and controls that respond as an agent’s behavior changes. The direction is clear: an agent should receive access appropriate to its task and risk, rather than inherit broad permissions by default. Microsoft Security Blog
That is an important step for enterprise software.
But when an agent interacts with a physical environment, the consequences extend beyond digital access.
An agent might be technically able to reach a building management system. That does not mean it should be able to change the temperature in every critical room.
A drone might be available for inspection. That does not mean it should be dispatched into every operational zone.
A robot might be capable of moving a component. That does not mean it should do so while people are working nearby.
Capability, access and authority are three different things.
What a work permit can teach Physical AI
Many industries already use permit-to-work systems for activities that require specific controls.
A qualified worker may have access to a site, but a particular task can still require authorization for a defined location, period and set of conditions.
The permit establishes what work is allowed and what must be in place before it starts.
A digital work permit for an AI agent could apply a similar idea:
- Who: Which agent or machine is acting?
- Why: What task is it performing?
- Where: Which site, zone or spatial boundary applies?
- What: Which asset or asset group is in scope?
- Action: May it observe, inspect, recommend or change something?
- Conditions: What must be true before and during the task?
- Evidence: What information is required before and after the action?
- Time: When does the authority begin and expire?
The principle is straightforward: grant the minimum authority needed for the task and remove it when that task ends.
This is a proposed design approach. It should support an organization’s existing safety procedures, approvals and engineering controls not replace them.
Consider Transformer T17
Imagine a utility uses an AI agent to investigate a potential vegetation risk near Transformer T17.
The agent receives a digital permit with the following scope:
Permit element Illustrative authorization
Mission - Assess a possible vegetation clearance issue
Location - Substation A, Zone 3
Asset - Transformer T17 and specified connected equipment
Permitted actions - Read relevant records, review imagery and create an issue
Control authority - None
Evidence required - Recent visual and thermal observations, where appropriate
Validity - 10:00–12:00
Decision level - Advisory; intervention requires human approval
The agent can investigate and document the concern. It cannot change settings, operate equipment or authorize vegetation removal.
If it finds insufficient evidence, it can recommend a further inspection. A separately authorized person or system must decide whether that inspection can proceed.
If the site conditions change, the permit may need to be suspended. If the validity period ends, it expires. If the mission is completed, the authority should be closed.
The example illustrates an important distinction: a useful agent does not need unlimited authority.
Authority must change when conditions change
A permit issued at 10:00 should not necessarily remain valid until 12:00 just because the clock says so.
Suppose an emergency is declared at the substation. Or a restricted area is expanded. Or the asset identity cannot be confirmed. Or the inspection evidence is older than the task permits.
The system should be able to pause the workflow and request review.
This requires more than a static permission list. It requires a connection between:
- The physical context: the site, asset, location and current operating conditions.
- The evidence context: what is known, how recently it was observed and how reliable it is.
- The authority context: who approved the task, what actions are permitted and when they cease to be valid.
A high-confidence AI prediction alone should not grant authority. A system may be confident about a problem and still lack permission to intervene.
For higher-consequence work, the organization may require independent checks, human approval and physical safeguards. If connectivity is lost or conditions cannot be verified, the permitted response must be defined in advance.
A new role for the digital twin
Digital twins are often presented as environments for visualizing assets, monitoring conditions or simulating scenarios.
Those functions matter. But Physical AI introduces another possible role: helping establish the context in which an action is permitted.
For that, a digital twin needs more than a convincing 3D model. It needs reliable relationships between:
- Assets: What exists, and which physical instance is involved?
- Evidence: What supports the current understanding of its condition?
- Dependencies: What else could be affected?
- Authority: Who or what can perform a particular action?
A spatial model can show where T17 is. An evidence record can show when it was last inspected. An authority record can define whether an agent may inspect it now.
Together, these can make a decision more traceable. They cannot, on their own, guarantee that the physical world matches the model. Asset identity, site conditions and permitted actions still need verification at the point of work.
Start with observation, then earn the right to act
Organizations do not have to begin with autonomous control.
A practical first step is to use AI agents for bounded, low-consequence tasks:
- Review evidence for a named asset.
- Identify missing or conflicting information.
- Prepare an inspection recommendation.
- Draft an issue for human review.
The next stage might allow an agent to initiate a workflow within defined limits. Physical intervention should be considered only when the organization can demonstrate that the authority, verification and safety controls are appropriate to the consequence.
Each step should leave a record: what was requested, which evidence was used, who approved it, what happened, and why the authority expired or was revoked.
That record matters for more than incident investigation. It helps teams understand where permissions were too broad, where evidence was insufficient and where a workflow can be improved.
The question for leaders
The commercial appeal of Physical AI is easy to understand: faster inspections, better coordination and fewer delays between detecting a problem and responding.
But speed creates value only when the organization can trust the resulting action.
For infrastructure owners, the question is not simply whether an AI agent can operate a tool. It is whether the organization can define and enforce the boundaries of that operation and explain them afterwards.
The next stage of Physical AI may depend as much on knowing when an agent must stop as on knowing what it can do.
