Govern what humans and agents command on the floor.

Approval, safety invariants, denial, and a trace stitched across edge hosts are all in the protocol today. This page shows how they would come together for industrial operations; the operational hardening is what we build with a design partner.

Read the essay: “Who commanded the machine?” →

The pain

Work orders, dispatches, and machine commands are increasingly issued by software and agents, not just people. When something goes wrong, you need to show who or what commanded the action, whether it was approved, and whether a safety condition was checked.

The trigger

A safety incident or an audit asks: “Who authorized this command, and was the required check in place?” Stitching that together across the PLCs, services, and edge devices involved is currently a manual investigation.

Who owns it

Operations and controls engineering, with plant IT — accountable for safe, authorized action and for the record that proves it.

What CHP would do

A command crosses a capability boundary that requires approval and can declare a safety invariant; the action is denied at the boundary if a condition fails. Hosts across the floor share one correlation, so a process spanning many machines replays as a single ordered trace. (Real-time control loops stay out of scope — CHP governs and evidences the boundary above them.)

The demonstrated record

A command, gated and accounted for.

This is a real CHP outcome for a dispatch action: the boundary denied it because a required entitlement was missing — a first-class, replayable decision rather than an exception buried in a controller log. The same shape carries an approval or a passed safety check.

Demonstrated, not yet shipped: approval, invariants, denial, and cross-host correlation exist today. Plant-grade hardening and integration are what we build with a design partner.

dispatch outcome — denied at the boundary

json

{
  "invocation_id": "inv_session_abc_001",
  "capability_id": "schedule_technician",
  "capability_version": "1.0.0",
  "correlation": { "correlation_id": "session-abc" },
  "outcome": "denied",
  "success": false,
  "data": null,
  "error": null,
  "denial": {
    "code": "entitlement_denied",
    "message": "service:dispatch is required",
    "retryable": false
  },
  "evidence_ids": ["evt_8f3a1c"],
  "started_at": null,
  "completed_at": "2026-06-16T15:14:22.104Z"
}

Automating dispatch or machine actions?

Bring a real command flow. We’ll map approval and safety invariants onto the protocol and stitch the edge trace with you.

Build it with us