Skip to content
Nexaform Technology Solutions
Asset Agents · Enterprise-grade

AI agent governance: your policies decide what agents may do.

Governance, human oversight, audit, security and AI safeguards are built into Asset Agents from the start. This page is written for the people who have to sign them off.

Talk to our engineers
Policy · Depot North · v7Active
Work ordersLevel 2 · approval
Service requestsLevel 3 · within limits
Safety-critical assetsAlways human approval
Parts value cap£2,500 per action
Change freezeFri 18:00 – Mon 06:00
Kill switchPause all agents
Governance

What you control

Policies are versioned, reviewed and approved like any other controlled change.

Autonomy level
Level per action type, for example Level 2 for work orders and Level 3 for service requests
Scope
Which sites, asset classes, criticality bands and work types each agent covers
Limits
Spend caps, maximum actions per day, labour hours and parts value
Approvers
Role-based approval by value and criticality, with escalation and delegation
Time windows
Change freezes, blackout periods and planned shutdown calendars
Safety
Safety-critical assets and permit-required work always need human approval
Kill switch
Pause any agent, site or action type immediately
Human oversight

Human in the loop: every action is proposed before it runs

Each approval is cryptographically bound to the exact action, is single-use and expires, so nothing can change between approval and execution.

  1. 01

    Propose

    The agent drafts the exact action: what, where, when and cost.

  2. 02

    Explain

    Evidence attached: data, history, confidence and alternatives.

  3. 03

    Approve

    The right person approves in the EAM, on mobile or by email, and can edit first.

  4. 04

    Execute

    Runs once, exactly as approved, under the approver’s identity.

  5. 05

    Record

    Decision, approver and outcome go to the audit trail.

Audit

AI agent audit log: a tamper-evident record of every decision

  • The data and documents the agent used
  • Model, prompt and policy versions
  • Reasoning summary and confidence
  • Tools called and what they returned
  • Proposed action, approver and timestamps
  • Outcome and follow-up

Tamper-evident

Append-only, hash-chained log. Any change is detectable.

Replayable

Re-run a decision with the same inputs and versions to see why it happened.

Exportable

Stream to your SIEM. Retention follows your policy.

Security

AI agent security, from identity to data

Identity

Single sign-on through your identity provider (SAML, OIDC) with MFA. No extra passwords.

Least privilege

Each agent has a scoped identity and never exceeds the approving user’s EAM rights.

Encryption

TLS 1.2+ in transit, AES-256 at rest, per-customer keys with a bring-your-own-key option.

Network

Private connectivity, egress allow-lists and no inbound access to plant networks.

Prompt-injection defence

Text from documents and work orders is treated as data, never as instructions.

Assurance

Secure development lifecycle, dependency scanning, signed releases and independent penetration tests.
AI safeguards

AI safeguards: accurate, accountable AI by design

Grounded in your data

Every number comes from your systems through tools. The language model never invents values.

Knows its limits

Low confidence or missing data produces a clear “cannot determine”, not a guess.

Tested before release

Scenario test suites and backtests on your history gate every agent and model update.

Monitored in production

Accuracy, acceptance and drift are tracked. Thresholds trigger review or rollback.

Your data stays yours

Customer data never trains shared models without explicit, written consent.

Your choice of model

Approved hosted models, models in your cloud account, or on-premises models.
Deployment

Deploy AI agents where your data needs to live

Nexaform Cloud

Multi-tenant SaaS with regional data residency. Best for pilots and mid-size estates.

Dedicated cloud

Single-tenant environment run by Nexaform, with isolated compute and storage.

Your cloud

Runs in your AWS, Azure or Google Cloud account. Data stays in your tenancy.

On-premises

For regulated or air-gapped sites, with locally hosted AI models.

Same product and features in every option.

Architecture

AI agent architecture: five layers, with control through every one

ExperienceEAM screens, mobile app, Teams and email approvals, APIs
AgentsOrchestrator plus condition, reliability, planner, parts, technician assistant and data steward
IntelligenceLanguage models, time-series foundation models, reliability models
KnowledgeAsset knowledge graph, search over manuals and work history
ConnectorsMCP tool servers for Maximo, SAP, Nexaform EAM, historians and IoT
Identity and accessPolicy engineApprovalsAudit trailObservabilityEncryption and keys

Bring your AI security questionnaire early

We would rather answer it in the first week than the last.

Contact ushello@nexaformtech.com