Brief · 8 September 2026 · David Reichwein
Hardware interlocks in the age of agentic AI.
In control engineering, a hardware interlock has one non-negotiable property: it removes the energy, path, or physical permission required to execute a hazardous act through an independent loop the proposed actor cannot alter, bypass, or persuade.
They do not make the operator wiser. They make an unauthorized motion physically incomplete.
The contact lives outside the proposer. Shared fate with the proposer is not independence.
01Two layers, not one
Physical plants already split the problem. Confusing those layers is the original error in agent governance.
Permissives · usually software
Is the fan running before the damper opens? Efficient. Also vulnerable to stuck outputs, corrupt state, and common-cause software failure.
A prompt that says “do not delete production” is a permissive.
Safety functions · interlocks
Guard opens, motor dies, even if the PLC still says RUN. The first layer asks whether the step is timely. The second asks whether the step is allowed to exist.
A path that cannot carry DROP unless an independent mechanism asserts enable is an interlock.
Plant panel
The damper listens to sequence. The motor listens to the guard — not to the PLC.
Damper command
Permissive
Sequence failed — still vulnerable to a stuck output
Motor power
Interlock
Live — guard closed
02Why the last layer cannot be software alone
High-consequence protection functions are written this way because of software common-cause failure: one bug, one corrupt state, one firmware halt can take every software instance down together.
NFPA 79 · IEC 60204-1 · ISO 13850
The stop must act on the path, not on the intention of the controller.
ISO 13849-1 · IEC 62061
Dual-channel architecture, diagnostic coverage, and demonstrated resistance to common-cause failure. Two copies of the same code on the same processor are not diversity.
IEEE 603 · NRC GDC 22, 24
After an assumed software collapse, something that is not the collapsed computer must still be able to trip.
These documents do not regulate language models. They regulate the structure of last-layer protection. If an agent can move money, destroy data, or command plant, that structure applies whether the proposer is a PLC, a tired engineer, or a model.
03Chatsworth, restated as architecture
On 12 September 2008, Metrolink 111 passed a red signal at CP Topanga and met a freight train. Twenty-five dead. The engineer was texting. Automatic Train Stop existed. It was not in force at that signal.
The lesson is not that humans are fallible
Present in the catalog, absent from the execution path, overridden when inconvenient.
Legislation by funeral mandated Positive Train Control afterward. The physics did not change. The permission to skip the physics did.
Agent stacks now ship with optional guards in the same position ATS occupied on that subdivision.
04Ten tests
Point at the candidate gate and answer yes or no. All yes: interlock. Any no: permissive. Useful, maybe. Last layer, no.
01/Path before commitment
Can you point to the wire, contact, or silicon path that removes the execution signal before commitment?
02/Physical enable or cut
Is there a physical enable or cut, not a flag the proposer can rewrite?
03/Independent fault domain
Does enforcement live in an independent fault domain — different processor, memory, and authority from the model?
04/Independent clock
Does it have an independent clock, so the proposer cannot starve or desynchronize the veto?
05/Isolated power
If the inference box dies, hangs, or is power-cycled hostilely, does the gate still default safe?
06/Non-bypassable
Is the policy non-bypassable — no alternate interface, shadow credential, or out-of-band tool path around the gate?
The test that kills most hardware pitches. A beautiful box the agent can route around is Chatsworth again.
07/Dark-model default
If the model goes dark, is the plant already safe, or does safety require the model’s cooperation?
08/Fail-closed
Fail-closed on drop, timeout, or undefined state?
09/Bounded grant
Is authorization bounded in time and context, or is a grant immortal?
10/Tamper-evident record
Is there a tamper-evident record the proposer cannot edit?
05What this does not say
Internal reasoning can be unbounded. External commitment cannot.
Reversible, low-radius, human-paced work can live on permissives. The primitive is for acts whose undo is a press release, a ledger, or a funeral.
They are often the right first interlock for software surfaces. They become counterfeit if they share fate with the agent or can be persuaded in-band.
The last layer should be too stupid to argue with. Anything that can understand the appeal can lose it.
06The architecture
Three domains. The only legal crossing is proposer → enforcement → target. Evaluation is of typed actions, not of the model’s inner monologue. Default is deny. Loss of the enforcement node is isolation, not a free pass.
Probabilistic
Model, agent, orchestrator. Allowed to be wrong.
Deterministic
Independent evaluator of structured proposals against explicit policy. Unreachable from the proposer’s namespace.
Money, data, machines
The ledger, the plant, the network. Reached only through enforcement.
Execution path
Isolated
07Failure modes of the gate itself
Those are not reasons to put the veto back inside the model. They are reasons to treat the gate as safety equipment: designed, tested, audited, and assumed capable of being wrong in its own way.
Becomes a rubber stamp or a shutdown.
Authorizes yesterday’s world.
Recreates the distracted engineer.
Becomes the common-cause fault.
Becomes fail-business. Then someone jumpers it out.