Triage, specialists, a shared chart, handovers and a signature before anything happens: a team of AI agents for the factory floor, built on Solace Agent Mesh, and why none of them can touch a machine.

The alarm that needs nobody

Somewhere between 85 and 99 percent of the alarms that sound in a hospital need no clinical intervention. The Joint Commission, citing studies of hospital monitors, put it that way in 2013, and within a year alarm safety was a national patient-safety goal for American hospitals. Staff stop hearing alarms that are almost always nothing. Occasionally one is not nothing.

Hospitals did not answer that by hiring a genius to listen to every monitor. They answered it with protocol: deciding which alarms matter, and who does what about each. It is how hospitals answer everything. Triage first, specialists by referral, a chart everyone writes on, handovers in a fixed shape, and nothing done to a patient without a signature.

Plants have the same problem, and are being offered the genius. The process industries' alarm standard, ISA-18.2, puts the most an operator can manage at about twelve alarms an hour, and calls ten in ten minutes a flood. Much of the AI arriving on plant floors this year is an assistant: one model that knows everything and answers anything, if someone thinks to ask it.

A plant does not need an AI genius. It needs a hospital.

Here is what that looks like. This note appeared on a compressor's topic, 44 seconds after the compressor's low-pressure alarm, in our own demonstration of a plant on a Solace event mesh:

Compressor 01 (comp-01) is running (Execute) but pressure 5.91 bar is below the 6.0 bar limit, triggering a critical low‑pressure alarm.

Likely cause is demand exceeding compressor capacity. First check the pressure sensor reading and upstream demand valves. Ops‑utilities team should own the investigation.

It is a triage note. It says what is happening and what the agent found, what it thinks is wrong, what to check first and who should take it. That is the shape hospitals use to hand a patient from one clinician to the next: SBAR, for situation, background, assessment and recommendation. We did not write the agent's instructions with SBAR in mind. We arrived at the same four parts because they are what the next person needs.

This piece walks through the rest of the hospital: agents that diagnose, plan the work, wait for a person's signature and hand over the shift, on Solace Agent Mesh, with none of them able to touch a machine. The estate is our own demonstration, made to prove a design: three illustrative plants, 63 machines, eight shop-floor protocols. It is not a client's. The note and the work order quoted here came from a recorded run. Where the piece says "the design", it describes the team as we would build it for a working plant.

Part one: triage

Triage first

In an emergency department the first person a patient sees is not the best doctor in the building. It is a triage nurse, with a few minutes, a fixed set of questions and one job: decide how urgent this is and who should see it next. The Manchester Triage System, used widely in Britain and Europe, sorts patients into five categories, from "immediate" to "non-urgent", each with a time within which they should be seen. The speed comes from the narrowness of the job.

The triage agent is built the same way. The compressor's alarm reached it through a Solace Agent Mesh entrypoint, a subscription whose only job is to turn an event into a task for an agent: in this hospital, the door alarms come in by. The agent read the compressor, and the alarms open at its site, through tools that can only read, and wrote at most 60 words. It may make six model calls for a task and no more, and it cannot reach any other agent. Its own definition describes it as woken by a machine, talking to nobody, and meant to be boring.

Triage here also keeps to the staffing. In this estate an alarm becomes a task only while someone has the plant on a screen, and no more than twenty times an hour. Another plant would choose a shift calendar or a budget. What matters is that the rule sits in the path the alarm takes, where it can be read and audited, and not in the agent's good intentions.

Everything goes on the chart

A good chart records not only a patient's blood pressure but who measured it, when and with what. Nobody on the ward takes it again because they doubt the last reading; they read the chart. Every claim in the note can be traced the same way.

"running (Execute)" came from one of the read-only tools, which answered from the plant's current state. That state was published by the compressor's interpreter, which reads the drive's running bit and fault code and turns them into one word from the PackML vocabulary. The agent's instructions forbid it to infer a state. Had the tool said "no data", the note would have had to say that the interpreter had gone quiet, which is a different fault with a different owner.

"5.91 bar" came from the same tool, which reported the latest reading with its age and its certainty. That reading started as two bytes in one Modbus register of the drive. Modbus never speaks first; a device answers whoever asks. In most plants every system that wants the number asks for itself, and five systems asking 63 machines is 315 conversations with controllers whose job is to run a machine. Here one interpreter asks, every five seconds, and puts the answer on the chart once, as a message on the broker like this one:

{
  "ts": "2026-10-05T10:57:35.882Z",
  "v": 5.88,
  "u": "bar",
  "q": "good",
  "src": {
    "proto": "modbus",
    "addr": "holding-register:1:UINT",
    "conn": "modbus-l5c9"
  }
}

That is 142 bytes for a number that is four of them. The rest record what a careful nurse would: the unit, how sure, when, and who took it. Solace's name for the interpreter is a Micro-Integration, and ours, for Modbus, is made with Solace's Micro-Integration Development Kit.

"below the 6.0 bar limit" and "critical" came from the alarm itself. "Likely cause is demand exceeding compressor capacity" is the alarm's own stated cause, repeated. The agent had no evidence of another and did not invent one; a triage nurse who is unsure says so, and leaves the diagnosis to the doctor. "First check the pressure sensor reading and upstream demand valves" is the agent's own judgement, worded as advice, and nothing in the plant's messages said it. "Ops‑utilities team should own the investigation" is a suggestion made from the machine's address, which puts it in the utilities area. It is the one clause a person should confirm, and the note sits on the machine's own topic, where a person will see it.

Figure 1. On the chart. Four of the note's six clauses trace back to messages the plant published. The last two are the agent's own advice, and are worded as advice.

First, do no harm

A plant engineer reading that note will ask one more question: could the thing that wrote it have touched the machine? It could not. The agent never spoke to the drive. The only thing in the design that talks to a drive is its interpreter, and the interpreter subscribes to nothing. There is no message an agent can publish that reaches a controller. Everything else in the plant, the agents included, reads the chart.

Figure 2. Only one thing touches the machine. One interpreter asks the compressor; everything else, the agents included, listens to Solace Event Broker.

Part two: the ward

Triage is deliberately small. The work around it, finding what is really wrong, planning the repair, getting a signature and handing over the shift, belongs to other agents, each with its own definition, its own budget and its own short list of tools. In the design there are five, and they keep the hospital's rules: whatever they write goes on the chart with its sources, and whatever they would do waits for a person.

Figure 3. The ward. Five agents on Solace Agent Mesh: what wakes each one, what it may read, what it writes and what it may never do. Heavy borders ran in the demonstration.

Specialists, by referral

In the design, a triage note on a critical alarm is a referral. It wakes a second agent, through an entrypoint of its own, without the triage agent knowing that agent exists. One published a note; the other subscribes to notes.

The diagnosis agent reads further back, as a specialist reads the history. The record holds every state, alarm and event the compressor has produced, a history store holds its readings, the maintenance system holds what was done to it last time, and the drive's manual is a document it can search. From those it writes a differential: a short list of causes, each with the evidence for it and the one observation that would confirm or rule it out. For comp-01 it would set the pressure beside the compressor's own power draw. Pressure falling with the motor at full load points to demand; pressure falling as the load drops points to the machine. Every claim carries its source, and where there is none it says so. When the evidence splits evenly, it asks. Agent Mesh lets an agent pause a task to put a question to a person and carry on with the answer, so the diagnosis can stop to ask whether anyone opened a valve on the header that afternoon.

It proposes. It does not decide, and it holds no tool that orders anything.

Nothing without a signature

No hospital operates because a specialist thought it a good idea. There is a plan, and there is a form a person signs.

In the design, a diagnosis that calls for work wakes the planning agent. It reads open and past work orders, the spare-parts stock, the technicians' skills and roster and the production schedule, and drafts a work order: what to do, which parts, which skills, how long, and when the line can spare the machine. Then it asks the maintenance system to open it, and the maintenance system waits for a person.

That last step ran in the demonstration, asked for by the copilot. The request went out as a message on the broker, carrying a return address. The maintenance system checked that the machine exists, raised an approval request on the compressor's topics, which the operator's screen shows as a card beside the alarm, and held its reply. Three clocks nest around that wait. A person has two minutes to decide, the request waits two and a half, and the conversation that asked waits three, so the window always closes from the inside. Twenty-three seconds after the request went out, a shift supervisor signed, and ticket WO-0001 was published on the compressor's topics.

Every field of the ticket has an author. The machine, the summary and the priority came from the agent that asked. The check that the machine exists, and the number, came from the maintenance system. The signature came from a person, and no agent has a tool that can write it.

Figure 4. Nothing without a signature. WO-0001 field by field, with the author of each part, and the three clocks that make the wait close from the inside.

The doctor you can ask

The copilot is the agent people talk to, the doctor on the ward who answers questions. It reads the same plant through the same tools, answers in the plain words of a production supervisor, and draws a diagram when one is clearer than a paragraph, saved as a file beside its answer. Its instructions let it ask for a work order when an operator asks, or when the machine's state plainly calls for one, and never "on your own initiative to be helpful". People reach it wherever they already work. Agent Mesh's entrypoints each handle one transport, its own web interface, Teams, Slack and email among them, so the copilot on the operations screen and the one in the maintenance team's chat are the same agent, with the same tools and the same limits.

Handovers lose nothing

Hospitals treat the change of shift as a risk, because what one team knew has to reach the next. That is why their handovers follow a fixed shape.

In the design, an event from the shift calendar wakes the last agent. It reads the record for the shift and writes the handover in the same four parts as the triage note: what happened, what was found, what is still open and what is waiting for a person. For comp-01 it would say that the compressor alarmed, that a note and a work order followed, and that WO-0001 was signed by the shift supervisor, and each line would link to the message it came from. It mentions nothing the chart does not hold.

Figure 5. The chart for comp-01. Six messages on one machine's topics, from the reading to the ticket: what a handover agent reads.

Part three: the hospital

The building, not the doctors

A hospital is more than its clinicians. It is the doors patients come in by, the desk that routes a referral to the right specialist, the rules about who may do what, and a chart that can be audited after the fact. Solace Agent Mesh is that building, for agents.

Its doors are entrypoints: one for events from the plant, others for people and the tools they use. Its referral desk is the orchestrator, which reads the cards each agent publishes when it starts, short records of what each can do, and hands a request to the agent whose card fits. When the copilot is asked why comp-01 keeps alarming, the question reaches the diagnosis agent without the copilot needing its name, and the person's permissions travel with the referral, so a chain of agents can never act with more authority than the person who started it. Its audit is the activity monitor, which traces each task as a graph of model calls, tool calls with what each was asked and what came back, and delegations to other agents. A new specialist, for energy or for quality, joins by being written, given a subscription and announcing its card. Nobody reorganises the ward.

What it costs

Every task is a bill. Each agent has a ceiling on its model calls: six for triage, ten for the copilot, more for diagnosis, set the same way. Each also names its own model, so a small, fast one goes where the work is routine and a larger one only where it is not. The staffing rule keeps alarms nobody is watching from becoming tasks at all. And the alarm that wakes the triage agent is acknowledged when it is received, not when the task completes. We had it the other way round once: a task that failed was redelivered, failed again, and kept going until it had spent the budget it was waiting for.

When you only need first aid, and not a hospital

If your operators see more than twelve alarms an hour, the first fix is not an agent. It is the one ISA-18.2 describes: rationalise the alarms, so that every alarm that sounds means something and has a known action. An agent triaging a flood of meaningless alarms is an expensive way to ignore them.

A known fix for a known condition is first aid: write it as a rule. One agent answering one team is a GP, and an agent framework inside one application is the right tool for it, as we said last month. The hospital earns its place when there are several agents, owned by different teams, woken by events as often as by people, and joined next year by specialists nobody has written yet. The same holds underneath. One plant with one or two systems that want its data is well served by a single MQTT broker with Sparkplug B, an international standard since 2023, and we build on that too.

Figure 6. First aid, a GP or a hospital. A rule for the known, one agent for one team, and a team on Solace Agent Mesh when the work crosses teams and starts from events.

Back to the compressor

The compressor was triaged 44 seconds after it alarmed, by an agent that could not touch it. Every clause of that note is on the chart with its source, down to the two bytes the interpreter asked the drive for. The work order that followed was asked for by an agent and signed by a person, and the record holds both for whoever takes the next shift.

That is what hospitals learned, at some cost: safety comes from protocol and from a team that knows its roles, not from genius. Agents write fluently whether or not they know, which makes that discipline more important for them, not less. Triage first. Chart everything. Refer; do not guess. Nothing without a signature. Hand over in a fixed shape.

A plant does not need an AI genius. It needs a hospital.

We have spent fifteen years building event-driven systems on that principle, in capital markets, aviation and IoT, and it has yet to be the wrong one.

Give us one production line and three weeks. We will put it on a Solace event mesh with a triage agent and a copilot on Solace Agent Mesh, every note charted with its sources and every work order signed by a person. The acceptance test is one you can watch: at the end, a third agent joins without anyone touching the first two, or the controller. And if one plant, one broker and one assistant are all you need, start there. We will tell you so, and help you build it.