Allow-list
An agent can only write to tags declared for it.
Security and food safety
Software that can move a setpoint in a food plant needs more than a good model.
Milkeon is designed around three facts: dairy is safety-critical, recipes are intellectual property, and the plant's existing automation must keep running if Milkeon stops. This page is the design posture; certifications are on the roadmap and not claimed.
Illustrative scenario: Plant run · skim-milk-powder line + set-yogurt line · shared intake. Not a measured run.
Defense in depth
Six layers between a model and a setpoint
Limits
Per-tag rate and magnitude limits, declared and versioned.
Stage
Shadow, assist or bounded, set per loop; nothing writes in shadow.
Policy engine
Interlock state, product, shift and operator presence evaluated before every write.
Human gate
Anything above the threshold, every CCP-adjacent move and every release waits for a named person.
Fallback
If Milkeon stops, the plant runs on its existing PLC and SCADA control and interlocks.
Tool calls
Every call, on the record
Every tool invocation, argument and result is written to an immutable, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant. The log below is the scenario run, not a measured one.
- 05:10:02mes.read_order({ lot: "T-0417", products: ["SMP", "SET-YOG"] })
- 05:10:02ok specs locked · HACCP plan v7 · CCP: pasteurization 72 °C / 15 s
- 05:10:03lab.read_results({ lot: "T-0417", test: "antibiotic_screen" })
- 05:10:03ok negative · lot accepted for intake
- 05:10:04twin.simulate({ candidates: 24, horizon: "shift" })
- 05:10:45ok best recipe #9 · pasteurization margin held · lowest energy per kg
- 05:10:46policy.evaluate({ recipe: 9, stage: "bounded" })
- 05:10:46ok 7 writes permitted · 1 write requires human approval
- 05:10:47plc.write_setpoint({ tag: "SEP1.BLEND_VALVE", basis: "nir+midir+lab" })
- 05:13:52ok skim solids on target · yogurt-stream fat at minimum safe margin
- 05:13:53plc.verify_ccp({ tag: "PAST1.HOLD_TUBE", min: "72 °C / 15 s" })
- 05:13:53ok CCP verified · divert valve armed · readings → audit log
- 05:14:10dose.culture({ vat: "Y2", lot: "C-2291", profile: "set-yogurt" })
- 05:14:10ok acidification curve predicted · hold timed to target pH
- 05:14:12approval.request({ action: "dryer.inlet", reason: "above bounded envelope" })
- 05:16:00ok approved by the shift dairy technologist · tighter moisture alarm set
- 05:16:01plc.write_setpoint({ tag: "DRY1.INLET_T", mode: "min_energy" })
- 05:16:01ok predicted outlet moisture inside spec · fouling risk low
- 05:16:02vision.stream({ cameras: 16, models: ["fill_seal", "foreign_body"] })
- 05:41:18reject: seal fault · unit 1184 · attributed to seal-jaw temperature drift
- 05:41:19defect.attribute({ event: "seal_fault", cause: "pack_line.jaw_temp" })
- 05:41:19ok packing line notified · second reject at 05:43:02 · drift corrected
- 05:41:20cuopt.schedule({ assets: ["PAST1", "DRY1"], window: "energy_low" })
- 05:41:20ok CIP sequenced · release checks armed
- 09:36:40mes.release_batch({ batches: ["SMP-0417", "YOG-0417"], genealogy: "full" })
- 09:37:52ok both batches released · scenario complete
Reasoning trace
Goal, plan, thought, action, observation, exactly as the orchestrator would record it.
GoalReceive tanker lot T-0417, standardize it once, pasteurize onc…
Receive tanker lot T-0417, standardize it once, pasteurize once, and run a skim-milk-powder stream and a set-yogurt stream to spec with full genealogy.
PlanSimulate the whole recipe on the twin first. Lead with composi…
Simulate the whole recipe on the twin first. Lead with composition so the dryer gets the right solids and the vat gets the right fat. Verify the pasteurization critical control point continuously. Let the dryer chase minimum energy only inside the bounded envelope; hold anything beyond it for a human.
ThoughtThe standing recipe over-standardizes both streams to protect …
The standing recipe over-standardizes both streams to protect against lab-sample lag. With continuous NIR and mid-IR estimates the blend can sit at the minimum safe margin. The saving is composition give-away, not safety margin: the pasteurization CCP is never a candidate for optimization.
Actiontwin.simulate(candidates=24) → recipe #9: minimum safe composi…
twin.simulate(candidates=24) → recipe #9: minimum safe composition margin, pasteurization margin unchanged, lowest predicted energy per kilogram of powder.
ObservationRecipe #9's dryer inlet temperature sits above the site's boun…
Recipe #9's dryer inlet temperature sits above the site's bounded envelope. The policy engine routes that single write to the shift dairy technologist and permits the other seven.
ActionExecute recipe #9 at the bounded stage: separation and standar…
Execute recipe #9 at the bounded stage: separation and standardization writes, CCP verification, culture dosing and the vat profile proceed; the dryer inlet write waits.
ObservationApproval granted at 05:16:00 with a tighter outlet-moisture al…
Approval granted at 05:16:00 with a tighter outlet-moisture alarm. Two seal rejects on the yogurt packing line were attributed to seal-jaw temperature drift and corrected by the packing line.
OutcomeScenario complete. Both batches released with composition, CCP…
Scenario complete. Both batches released with composition, CCP records, culture lot, drying setpoints, inspection events and the human decision in the genealogy. No measured plant result is claimed; this is the run the platform is designed to execute.
Guardrails
An agent that can move a setpoint needs a leash
Milkeon writes to production equipment in a food plant. Every capability is scoped, every write is policy-checked, every output is cited, and every action is written to an append-only audit log the plant owns.
- Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate and magnitude limits, at the autonomy stage the plant has set.
- Critical control points are read, never written. Pasteurization time-temperature, flow diversion and release decisions stay with the HACCP plan and the people who own it.
- Policy engine before every write. Autonomy stage, interlock state, product, shift and operator presence are evaluated before a setpoint moves.
- Grounded and cited. Every recommendation carries a citation to the recipe, spec or procedure it relied on. Retrieval is tenant-isolated and permission-aware.
- Immutable audit log. Append-only, exportable and retained on the plant's own storage, aligned to HACCP, FSMA, ISO 22000 and FSSC record-keeping.
- Hard fallback. If the edge node, the network or a model stops, the plant keeps running on its existing PLC and SCADA control and interlocks.
- Tenant and IP isolation. Recipes, supplier data and tolerance models never cross a customer boundary. On-prem deployment available.
Assurance posture
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I | Cloud control plane | QUEUED Roadmap, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Roadmap, 6 to 12 months |
| HACCP · FSMA · ISO 22000 · FSSC · Codex | Grounding and record-keeping | RUNNING Design basis for retrieval and the audit log |
| Per-tenant isolation | Data, memory, models | RUNNING Design rule |
| On-prem deployment | Recipe-sensitive producers | RUNNING Design option |
Milkeon supports your food-safety records. It is not a certification and it does not replace your HACCP plan.
Autonomy
Four stages, set per loop
A plant does not go from manual to bounded control in one step. Milkeon makes the stage explicit per loop, auditable and reversible at any time, and some decisions never leave the person.
| Stage | What the agent does | What the person does | When |
|---|---|---|---|
| Shadow | Predicts composition, contamination, moisture and takt; writes nothing | Runs the plant as today; compares predictions to lab results | First phase with every design partner |
| Assist | Recommends separation, pasteurization, culture and drying moves with the evidence | A dairy technologist or process engineer approves or corrects each one | After accuracy is proven against the baseline |
| Bounded | Writes low-risk separation, drying and inspection setpoints inside explicit limits | Approves anything above the limits; reviews the shift record | After the food-safety and ROI gates agreed up front |
| Exceptions | Escalates anything outside its envelope, CCP-adjacent moves and release decisions | Always decides these; the agent never does | Permanent |
Assurance
Certification status
Stated plainly. Items on the roadmap are roadmap items.
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I | Cloud control plane | QUEUED Roadmap, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Roadmap, 6 to 12 months |
| Food-safety and sustainability assurance packages | Design partners | QUEUED Roadmap, 6 to 12 months |
| HACCP, FSMA, ISO 22000, FSSC, Codex | Grounding and records | RUNNING Design basis; not a certification of Milkeon |
| IP-safe deployment | Recipes, supplier data | RUNNING Design rule; on-prem option |
OT safety
Failing safe is a design requirement
- Supervisory, not primary. Milkeon sits above existing PLC and SCADA control; it never replaces an interlock or a safety system.
- Critical control points are read-only. Pasteurization time-temperature and flow diversion are verified and logged, never written.
- Release is human. The conformance agent assembles the genealogy and checks it against spec; a person releases the batch.
- Loss of Milkeon is loss of advice. The plant degrades to the way it runs today, not to a stop.
What leaves the plant, and when
| Data | Where it stays |
|---|---|
| Recipes, specs, tolerance models | Tenant-scoped; on-prem option |
| Supplier and milk-supply data | Tenant-scoped |
| Audit log and genealogy | The plant's own storage, exportable |
| Safe abstractions of rare faults | Transfer across similar lines, privacy-preserving (planned) |
Multi-agent handoff
Agents negotiate, they do not collide
Two agents will want the same actuator. The orchestrator arbitrates on the run goal, with food safety above everything, and the handoff is logged like any other step.
Contested move: pasteurizer flow rate
-
01yield_takt.request(flow +6%) SUCCEEDED0.2 s
Yield-and-Takt wants more flow through the pasteurizer so the powder stream starts earlier and the dryer is not left waiting.
-
02pasteurize_homog.request(flow hold) SUCCEEDED0.2 s
Pasteurize-and-Homogenize requires the flow that keeps holding time at or above 15 s at 72 °C. That is the HACCP critical control point.
-
03orchestrator.arbitrate SUCCEEDED0.4 s
Food safety outranks takt under every run goal. The critical control point wins the actuator; the request for more flow is logged with its score and the reason it lost.
-
04yield_takt.handoff(resequenced) SUCCEEDED90 s
Yield-and-Takt recovers the schedule by starting the evaporator on the first standardized skim instead of waiting for the full tank. Takt is met without touching the CCP.
Arbitration rules
- Run goal first. Every request is scored against the declared goal, not against the requesting agent's local objective.
- Food safety outranks everything. A critical control point is never an optimization variable. A pasteurization or seal escape is a recall; a takt miss is a schedule.
- Time-boxed ownership. An agent holds a contested actuator for a bounded window, then must re-justify.
- Everything is logged. The losing request, the score and the reason all appear in the run record.
- Deadlocks escalate to a human rather than resolving by timeout.
Enterprise
Standardize autonomy across the group
One policy model, one audit trail and one set of yield, loss, energy and water benchmarks across every plant in the group, with each site's recipes and tolerance models kept private to that site.
- Multi-site plant-edge fleet with shared model governance
- Custom product, composition and tolerance models per site
- SSO and role-based access, named approvers (roadmap, 6 to 12 months)
- Model versioning, validation reports and rollback
- On-prem or private-cloud deployment
- SLAs and outcome-based components on the highest-value workflows
FAQ
Straight answers
The questions plant directors, technologists and quality managers ask in the first meeting.
Only at the autonomy stage your plant has set, and only to an explicit allow-list of low-risk loops inside explicit limits. Every design partner starts in shadow mode, where Milkeon predicts and writes nothing. Assist mode follows, where a technologist approves each recommendation. Bounded autonomy on separation, drying and inspection loops comes after the food-safety and ROI gates agreed up front.
Critical control points are not optimization variables. The pasteurization CCP, the flow-diversion interlock and release decisions stay with your HACCP plan and your people. Milkeon verifies readings, writes them to an immutable audit log and attaches them to the batch genealogy. It supports HACCP, FSMA, ISO 22000 and FSSC records; it is not a certification and does not replace your plan.
Milkeon sits above your existing automation as a supervisory layer. If it stops, the plant keeps running on its current PLC and SCADA control and the interlocks it already has. A Milkeon outage degrades the plant to the way it runs today, not to a stop.
The first phase is shadow mode on one line: Milkeon reads your analyzers, PLC history, lab results and MES while you run the plant as usual, and we measure its predictions against your lab. Recommendations start when accuracy is proven against that baseline, and improve as plant-specific history and technologist corrections accumulate.
Recipes, product specs, tolerance models and supplier data are tenant-scoped and never used to train another customer's models. Retrieval is multi-tenant isolated and permission-aware. On-prem deployment is available for processors protecting sensitive recipes.
You are, the same as with any control strategy. That is why every write is policy-checked, bounded, logged and reversible, every output carries a citation to the recipe or procedure it relied on, and anything above your threshold waits for a named approver. The audit log records the request, the reasoning, the limits applied and the human decision.
As a design partner, on one line, with one hard metric: fat or protein give-away, energy per kilogram of powder, moisture or composition variance, or contamination escapes. We instrument the line in shadow mode, measure the baseline, move to assist mode when accuracy is proven, and expand only when the number holds.
Full multi-module autonomy across the whole plant, long-tail integrations beyond the design partners' stacks, and self-serve onboarding. The first release is one wedge workflow, its connectors, the agent loop with human checkpoints, the review console and the food-safety audit log.
Get started
Get the security pack
The design posture, the data flows and the roadmap dates, written for a quality manager and an IT/OT lead.