Human oversight sets the boundary between a digital twin’s recommendation and an action on the physical system. An agent may analyze current conditions and propose a change, but its authority should depend on the consequences of getting that change wrong. Oversight is therefore more than watching a dashboard: decision boundaries must be documented and enforced in the system. section 1.2.5 section 10.5.1
Assign each decision an explicit authority tier:
- Advisory: the twin supplies a forecast or recommendation; a person decides whether to act. Maintenance prioritization is one example. section 10.5.1
- Guarded automation: the twin may act only within predefined constraints or after human approval, as with equipment throttling within safe operating ranges. section 10.5.1
- Autonomous execution: the twin acts without intervention for suitable low-risk, high-frequency decisions, such as sensor recalibration. section 10.5.1
Assess failure consequences before choosing a model or granting control authority. Minor comfort adjustments may be automated; decisions affecting safety, equipment, or operations call for conservative control. Predictable rule engines, thresholds, or physics-based models may be preferable in high-stakes cases. If AI proposes an action, a human-in-the-loop workflow can present the proposal and its supporting context to an operator, then wait for approval before sending any physical command. section 8.5.2
Separate a constraint from an approval
An irrigation controller can send an activation request and the latest soil-moisture reading to Open Policy Agent before starting a zone. A policy rejects activation when moisture exceeds 80%; a request reporting 85% is denied. That check enforces one operating constraint—it does not itself provide human approval. If a decision requires authorization, the workflow must also hold the command until an operator approves it. section 10.5.1 section 8.5.2
package digital_twin.irrigation
import future.keywords.if
default allow_operation := true #1
allow_operation := false if { #2
input.command == "activate_zone"
input.sensors.soil_moisture > 80
}
This Rego policy illustrates a coded boundary: it changes `allow_operation` to false when an activation request reports soil moisture above 80%. Its default is true, so it should not be mistaken for a complete authorization policy. section 10.5.1
Oversight also applies before and after deployment. Industrial twins often begin as advisory systems because a bad recommendation can affect safety, operations, or the environment; extracted values may need expert validation before use. Run new models alongside existing logic without immediately influencing the physical system, and require approval before high-risk changes trigger real actions. Revisit who makes each decision as assets, conditions, regulations, and the twin’s capabilities change. section 2.6 section 10.3.3 section 10.4
