The agent is online. The control plan isn't.

Here is an uncomfortable observation. In every plant where I have run quality, a temporary worker on day one could not approve a supplier deviation, close an 8D or sign off a lot. First they needed a qualification matrix, a trainer's signature and a personnel file to prove it. This week the conversation moved again: CIO published data on governing the “agent workforce”, Deloitte wrote on identity security in the age of AI, and OneTrust shipped tooling for the “agentic governance gap”. The industry's collective answer to software that acts on live systems is another layer of policy. The temp who swept the floor had a personnel file. The agent that moves six-figure purchase orders has an API key. An autonomous agent is an unqualified temporary worker with write access to production systems. The discipline that fixes that is not a policy. It is a control plan.

An agent is a temp with no personnel file

Map agentic failures onto failure modes a quality engineer already knows and the category error collapses. An agent gets credentials where an operator gets onboarding. Scope where an operator gets a qualification record. And it loses all context between sessions, where an operator at least gets a shift handover. None of this is exotic. These are the three missing controls that got plants into trouble decades ago.

• No onboarding. A service account with write permissions is not training. It is the keys to the stores handed over on day one, before anyone has watched the new hire work.
• No qualification record. Under IATF 16949 and AS9100, anyone touching a product or safety characteristic has evidence of competence on file. Most production agents have a README and a demo video.
• No shift handover. Context rot between sessions is an operator change with no communication. The next run starts confident, minus every caveat the previous run learned.

The parallels keep coming. Drift is tool wear: gradual degradation that only surfaces in the output data. A hallucination is a confident operator reading the wrong drawing. Prompt injection is foreign material in the process stream, invisible until inspection. Shewhart separated common cause from special cause a century ago; the governance debate has not discovered the distinction yet.

What a control plan looks like for software that acts

A control plan, in the APQP sense, answers four questions for every characteristic: what can go wrong, how it is measured, who owns it, and what happens the moment it drifts out of specification. The last column is the one that matters. It is also the one a policy cannot write. Reaction plans are not escalation e-mails. In a plant the reaction fires by itself: quarantine the lot, stop the line, hold the shipment. When GM recalls 67,000 EVs over potential brake failure, nobody works root cause while affected cars keep shipping – containment first, interrogation second. That reflex is QRQC, and it was the first habit I built into the greenfield QA department I stood up at SNOP for 900+ employees. It transfers unchanged to a misbehaving agent: freeze the scope, revoke the write, quarantine the last hundred actions.

A policy decides who answers for the failure. A control plan decides what the system does in the first four seconds of one.

Then the structural controls. Segregation of duties: an agent proposes, and a human or an independent check approves above a defined threshold – no system executes and self-verifies a consequential action. You can stop a press mid-stroke, so you must be able to stop an agent mid-task, not mid-quarter. Least privilege: I have spent enough time on the disclosure side of security to know that write access is the entire game, and most agent scopes are granted, not engineered. And the rule the AI industry treats as heresy: every model update is an engineering change. Under IATF, changing a tool on a safety characteristic triggers re-qualification. Swapping the model behind an agent that approves, writes or dispatches is the same class of change. Treat it as one, and regression-test against a frozen golden set before it touches production.

Why no single model deserves release authority

I built MultiPS, a multi-model orchestration platform that runs 63+ models in parallel and synthesises consensus; it is in private beta. The redundancy was never a feature. It was poka-yoke. Models fail in uncorrelated ways – one mangles arithmetic, one invents citations in perfect grammar, one is confidently wrong in a register that survives review. A single model, however good, is a single failure path holding release authority. Consensus across independent models is detection by design: you cannot prevent the error inside the model, so you build a gate that one error cannot pass through alone.

There is a second dividend. A silent vendor update is an engineering change nobody approved, and in a consensus architecture one degraded model does not carry the decision – the disagreement becomes a signal, the signal becomes a reaction-plan trigger. The trade-off is honest, and I pay it monthly. Consensus adds latency, seconds rather than milliseconds, and a consensus pass burns roughly an order of magnitude more tokens than a single call, which at current pricing is real euros per decision. I spend that where consequence is high and skip it where it is not, the same triage a control plan applies to characteristics. You do not 100% inspect everything. You poka-yoke what can hurt you.

The EU AI Act has entered its enforcement reality: registers, classifications, documentation duties. All of it is the personnel file, and none of it is the control. Stellantis credits quality “war rooms” for its turnaround because containment beats correspondence – a lesson that predates every framework now being sold to govern agents. Register the agent if the law demands it. Then qualify the action before you ship it, or contain the escape after. The second option is always the more expensive one.