The models vote. The failure is unanimous.

A TRiSCM vendor announced 514% growth this quarter, selling platforms that watch what AI agents do. I read the number twice, then thought about a gate interlock on a transfer press I used to walk past every morning. Open the gate and a positively guided contact cut servo power. No alert, no report, no lessons-learned meeting – the press simply could not close on the hand that reached in. Watching is not controlling. Assembly lines settled that argument before I was born, and they settled it with hardware, not software.

Autonomy was never the hard part

Transfer lines have run unmanned night shifts since the 1980s. Robots weld, CNC cells cycle, pallet conveyors flow, nobody stands over them. Autonomy in manufacturing is middle-aged. What made it safe was never cleverness; it was architecture. Light curtains wired to drop power. Two-hand controls. Safety PLCs running 1oo2 and 2oo3 voting logic in channels physically separated from the standard controller, because nobody trusted an ordinary PLC to guard a human body.

The agentic-AI debate is functional safety rediscovered, minus the discipline. The sharpest line in enterprise commentary this week came from ET Edge Insights: agentic AI's biggest risk is not intelligence – it is control. Right question, decades late, and the market's answer so far is observation software. Across two decades of automotive and aerospace quality – IATF 16949 audits, AS9100 audits, more VDA 6.3 process audits than I can count – I never once heard an auditor accept we monitor it as mitigation for a hazard. Detection is not a barrier.

When I built the quality function of a 900-person greenfield plant from zero, we wrote the control plans around interlocks and poka-yoke; nobody once proposed swapping them for software. At WITTE, QRQC and A3 tore real money out of the cost of poor quality – by eliminating failure modes, not by observing them more elegantly.

What voting buys – and what it doesn't

I live inside this problem. I designed and run a private-beta platform, MultiPS, that fires each query at 63+ models in parallel and synthesises consensus from their answers. On a good day it works like 2oo3 voting in software: one model invents a clause number, sixty anchor on the correct one, and the synthesis flags the outlier instead of averaging it away. When sixty models agree and three dissent, that divergence is the most valuable thing on the page. A single hallucination cannot survive an independent jury.

Notice what I did not claim. I did not claim the vote is true. Voting protects you against the channel that fails alone; it does nothing against the failure every channel shares. Voters that fail identically are not redundant – they are one voter counted sixty-three times.

Common cause eats redundancy for breakfast

Functional safety learned this expensively. Redundant channels sharing a power supply, a sensor principle or a code library fail together, which is why IEC 61508 pushed engineers toward diversity: different physics, separate supplies, distinct logic solvers. Now run that analysis on frontier models. Most are trained on overlapping crawls of the same internet, tuned toward the same preferences, graded on similar benchmarks. Their knowledge correlates. Their blind spots correlate. Ask about anything outside the shared training window and you get synchronised ignorance with matching confidence.

The attack writes itself, and I say that as someone who has worked the attacker's side of the fence – certified ethical hacker, listed on T-Mobile's public bug-bounty Hall of Fame for clickjacking. An attacker hunts shared dependencies, and with agents the shared dependency is context. Plant one injected instruction in a retrieved document and every model reading that context inherits the same lie: sixty-three unanimous, fluent, confident wrong answers. The vote passes. The failure is unanimous.

Unanimity is not proof of truth. It is a single point of failure with excellent attendance.

So diversity has to be engineered, never assumed: different model families rather than siblings from one lineage, separate retrieval provenance so one poisoned document cannot feed every voter, independent tool permissions for each agent. High-severity actions – payments, deletions, releases, anything outbound – get a hard gate, human or system-level, that the agents cannot open themselves. An interlock does not take a vote.

Buy the interlock, not the dashboard

The market is scaling the other way. The TRiSCM vendor grows 514% on observation, large security names are extending their AI-security partnerships in the same direction, and with the EU AI Act phasing in, boards are answering governance pressure by buying visibility. Visibility of an escape is not containment of an escape. Your auditor – and the AI Act – will not ask what you observed. They will ask what fails safe when the agent is wrong, compromised or fluently hallucinating.

A dashboard tells you what the agent did. A control architecture decides what it can do. Different products, different budgets, different postures.

Tomorrow morning the sixty-three models on my platform will vote, and on most mornings they will be right. The architecture is not for those mornings. It is for the morning they are wrong together – shared prior, poisoned context, unanimous verdict – when the only question that matters is what your system could not do. Assembly lines answered this decades ago, in hardware. Agentic AI will answer it eventually; the only variable is whether the answer arrives as architecture or as an incident report. Buy the interlock, not the dashboard.