AI agents can interpret documents, call tools, and interact with systems that influence real-world operations. In industrial environments, however, generating a valid command is not the same as having permission to execute it.

An agent might review a maintenance log, consult an equipment manual, and recommend an action. But what happens if a retrieved document contains malicious instructions? What if an operator's approval expires before execution, or a command's parameters change after approval?

These scenarios highlight a core principle of Physical AI security: the component that proposes an action should not be the only component that decides whether the action is authorized.

This article explores how to separate AI reasoning from command authorization and how to test that boundary before connecting an agent to physical equipment.

Treat Retrieved Content as Untrusted Input

Industrial AI agents may work with equipment manuals, maintenance logs, incident reports, operator messages, work orders, sensor…