MES / historian, read-only across OT/IT

Context

A plant-ops copilot sits on the IT side of the OT/IT boundary. The MES/historian server exposes only read tools — machine status, OEE, tag history. There is no write tool at all, so nothing the agent does can actuate equipment.

The decision

Read-only resource design is the OT safety guarantee: the absence of any write tool, not a permission setting, is what makes the copilot safe on the plant floor.

What most miss

People add a 'set_setpoint' tool behind an approval and think they're safe. On OT the guarantee people trust is the one that's structurally impossible — no write tool exists.

Stakes

A single actuation path from an IT-side agent onto OT equipment is a safety-of-life risk, not an incident ticket.