Here is an uncomfortable observation from two decades of chasing defects through automotive and aerospace plants: the brilliant station is almost never where the escape came from. The manufacturing press is full of multi-agent AI again – an $18 million round for AI "digital workers", a consultancy calling agents "the new force multiplier", panel after panel insisting that collaboration sits at the heart of the multi-agent approach. Every demo shows one agent doing something clever on one screen. Meanwhile, fresh data says 89% of agent deployments never reach production. I have watched this movie before, with cells instead of agents. The station was never the problem. The seam was.

Escapes are born at the seams

Run escape investigations for twenty years and the crime scenes repeat. Three of my worst weeks, all from QRQC and A3 work in automotive and aerospace:

The shift change. A bracket left the forming cell inside tolerance at 21:47 and reached assembly out of flatness. The root cause lived at 22:00 – the incoming shift ran a different first-off check, the hand-off was verbal, the boundary had no owner. Two weeks of investigation to find ninety seconds of neglect.

The cell-to-cell transfer. Parts passed final check, then spent a weekend in a rack that existed in nobody's PFMEA. Transport was the process, and nobody had written its control plan. €27,000 in sorting, rework and expedited freight.

The supplier-to-dock point. "Certified" meant a PDF nobody opened. The defect was born where trust replaced verification – the most expensive seam in any plant.

PFMEA has known this for five decades. Transfer, handling, storage, detection – the methodology treats every boundary as failure-mode territory, and 4M change sits on every checklist precisely because control is weakest where work changes hands. Plants skip the discipline anyway. Stations have owners; seams don't.

Nothing escapes from inside a station. Everything escapes across a seam.

An agent hand-off is a process hand-off

When agent A hands work to agent B, I demand the same four things I would demand at any cell boundary: an output characteristic – what exactly is passed, a number, a ranked list, a decision; a specification – schema, units, tolerances, a confidence floor; an acceptance gate – what B verifies before accepting, and what makes it reject; and a reaction plan – retry, reroute, quarantine, escalate. Miss one of the four and the hand-off is not a controlled operation. It is an assumption.

I learned this the long way at SNOP, building the QA/QC department for a greenfield plant of 900+ employees from an empty office. My real work was never the stations; process engineers owned those. It was defining every quality interface from zero – what left cell A, in what condition, with what evidence, accepted by whom at cell B. That experience is why MultiPS, the multi-model orchestration platform I designed and built, looks the way it does. It runs 63+ models in parallel with consensus synthesis. Not because a single model is stupid, but because an unaudited single output is a suspect lot. When four of sixty-three models disagree, that is not noise. That is a control limit tripping. And to stay inside my lane: I do not train models. I build the plant around them. The orchestration layer is a control plan. A group chat with API keys is not an architecture.

Write the control plan for the conversation

Four instruments, none of them exotic:

  • Data contracts. Every hand-off carries a declared schema – fields, units, versions, confidence – and the receiving agent validates before processing. No silent coercion, no best-effort parsing.
  • Stop-and-quarantine interlocks. A failed gate halts the chain and freezes the work-in-progress state. An agent that quietly "repairs" an out-of-spec input is a rework station nobody authorised – the software twin of the night shift that adjusted its own check.
  • Human escalation thresholds. Decide before deployment which disagreement rate or confidence drop pulls a person in. This is an andon cord. It is not optional.
  • Traceability on every hand-off. Inputs, model versions, prompts, gate decisions – logged. Otherwise your first 8D dies at D4 for want of evidence, and you re-run the chain and hope.

The security headlines this week tell the same story in a different vocabulary. Water-treatment intrusions, NIST expanding its OT guidance, CISA and the FBI warning operators about third-party ICS access, researchers showing that IT/OT convergence widens lateral movement – every one of them an interface nobody governed. Quality management, ethical hacking and agent engineering turn out to be the same job: finding where a system fails at its boundaries. Google Cloud's new secure agentic blueprint for manufacturing is welcome; hardened transport is table stakes. But encryption protects the pipe. It does not write your reaction plan.

Key takeaways

  • Put every agent-to-agent hand-off on the PFMEA: output characteristic, specification, acceptance gate, reaction plan – defined before the agents ever talk.
  • Treat an unaudited single-model answer as a suspect lot. Parallel models with consensus synthesis cost you latency; a silent, unverified output costs you quality.
  • Log every hand-off – inputs, versions, gate decisions – or your first 8D on an agent chain will stall at root cause with no evidence to analyse.
  • Security blueprints protect the transport. Only your control plan governs what happens when the content fails the gate.

The 11% of agent deployments that reach production are not the lucky ones, and mostly not the smartest-model ones. Their seams were engineered – specified, gated, logged, owned. The rest bought a station and called it a system. So run one purchase-order test on every vendor touring plants with a brilliant agent this quarter: ask them to make a hand-off fail on purpose. A serious platform will show you the quarantine, the escalation, the log entry – proudly. If they cannot, or will not, walk away. You are buying a station, not a system.