Most writing about AI in engineering software is about capability. This is about the opposite, because in a system of record the limits are the more interesting design.
A PLM holds the definition of what a company builds. An agent that can quietly change that definition is not a productivity feature; it is an unattributed editor with good intentions. So the useful question is not what an agent can do. It is what it is prevented from doing, and whether each prevention is a principle or a temporary limitation somebody will remove next quarter.
Four tiers
The clearest way to reason about this is a ladder, where every agent sits on exactly one rung and cannot reach the next one without a person moving it.
- Observe. Reads and reports. Finds a gap, names it, cites it. Changes nothing.
- Recommend. Proposes a specific action with a reason. A person accepts or rejects. Still changes nothing on its own.
- Prepare. Assembles a draft — a change request with its affected items resolved, a publication queued, a document revision written — that a person then submits. The draft satisfies the same validation a person's would.
- Execute. Acts. Deliberately rare, deliberately narrow, and deliberately not available for anything that alters a released definition.
Most of the value sits in the first two rungs, which is not the answer anybody wants and is what the evidence supports. The expensive failures in manufacturing data are failures of noticing — a document that went stale, a certification that lapsed, a publication that half-succeeded. Those are detection problems, and detection is exactly what a model is good at when it is pointed at structured data with clear questions.
Citations, and why they are a hard requirement
A finding without a citation to a specific object and field is not shown. Not ranked lower, not flagged as low confidence — not shown at all.
This sounds pedantic until you consider what the alternative produces. An agent that can report something it cannot point at is an agent that can be confidently wrong in a way nobody can check, and the cost of that is not the wrong finding. It is that after two or three of them, people stop reading the queue — and then the agent's true findings do not reach anybody either.
The requirement also does useful work upstream. Forcing every claim to resolve to an object and field means the agent cannot make claims about things the data does not contain, which eliminates a whole category of plausible-sounding output about intent, quality and risk that the system has no basis for.
An uncited finding is not a weaker finding. It is a different kind of thing, and mixing the two destroys the value of both.
Agents do not bypass validation
This one is short and absolute. An agent preparing a change produces a draft that satisfies exactly the same rules a person would face, and where it cannot, it reports which rule it failed.
The reason is not caution. It is that an agent able to bypass validation makes every rule in the configuration advisory, retroactively and silently. An organisation that has configured a gate condition — a revision cannot release without a linked specification — has made a decision about control. A component that can step around it has not been given an exception; it has quietly deleted the control while leaving it visible on the configuration screen.
Permissions belong below the agent, not inside it
An agent sees what its configured identity may see, and that is enforced at the data layer rather than in the agent's own logic.
The distinction matters more than it sounds. If permissions are enforced inside the agent — a prompt instruction, a filter applied to results, a scope check in the orchestration code — then the enforcement is only as good as the code path, and there will be more code paths next year. If enforcement sits underneath, in the query layer, then there is no agent behaviour and no prompt that can widen it, because the data never arrives.
This is what makes custom agents safe to offer at all. A company can write its own evaluation, in its own words, pointed at its own data, and inherit the permission model without having to be trusted to respect it.
The things worth refusing outright
A few capabilities are frequently requested and are worth declining rather than shipping carefully.
Assigning FMEA ratings. Severity is a judgement about consequence, occurrence is a judgement informed by data that is often absent, and detection is a judgement about a control's real rather than intended effectiveness. Software producing those numbers would be producing confidence, not analysis. What it can usefully do is put the nonconformance history next to the occurrence rating, so a rating of 2 on a component with eleven nonconformances is visibly questionable while somebody is looking at it.
Writing requirements. A requirement nobody deliberately wrote is a requirement nobody owns, and ownership is most of what a requirement is. Generated requirement text carries the appearance of intent without the deliberation.
Deciding that two part numbers are the same. Propose, with the differences named, and let a person decide. The cost of a wrong match is discovered in the field; the cost of a review is thirty seconds.
Resolving a disagreement between two systems. An agent can name the fields, the two values, the as-of stamps and which system is supposed to own it. Choosing which one is correct is editing a record with no authority to do so.
Why the limits are the product
It would be straightforward to ship an agent that does all of the above. It would demo extremely well, because every one of those outputs looks right at a glance — that is precisely the property that makes them dangerous.
The thing being sold in a system of record is not capability. It is the ability to answer, in two years, what was true and who decided it. Every autonomous write that lacks an author is a small withdrawal from that account, and the balance is not visible until somebody needs it.
So the design position is narrow and boring: agents find things, explain things, and prepare things. People decide things. That division is not a stage on the way to something more autonomous. It is the answer.