Allow-list
An agent can only write to tags declared for it.
Security and compliance
Software that can move a setpoint in a chemical plant needs more than a good model.
Tinteon is designed around three facts: coatings are made to customer standards under VOC permits, formulas are intellectual property, and the plant's existing automation must keep running if Tinteon stops. This page is the design posture; certifications are on the roadmap and not claimed.
Illustrative scenario: Plant run · one architectural deep tint base from dosing to pallet · bead mill, let-down tank, tint station, filling line. Not a measured run.
Defense in depth
Six layers between a model and a setpoint
Limits
Per-tag rate, magnitude and retint limits, declared and versioned, inside documented formula, tolerance, VOC, equipment and rollback bounds.
Stage
Shadow, assist or bounded, set per loop; nothing writes in shadow.
Policy engine
Interlock state, product, formula, shift and operator presence evaluated before every write; changes that leave a customer tolerance or touch a VOC limit are blocked.
Human gate
Anything above the threshold, every move against a standard or a permit limit and every release waits for a named person.
Fallback
If Tinteon stops, the plant runs on its existing mill, dispenser and filling-line control and interlocks.
Tool calls
Every call, on the record
Every tool invocation, argument and result is written to an immutable, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant. The log below is the scenario run, not a measured one.
- 05:40:02mes.read_order({ batch: "B-4471", product: "TB-DEEP-07", standard: "STD-2210" })
- 05:40:02ok formula locked · tolerance Delta-E v4 · VOC limit on product
- 05:40:03lab.read_results({ lot: "PIG-8831", test: "incoming pigment" })
- 05:40:03ok lot inside spec · accepted for dosing
- 05:40:04twin.simulate({ candidates: 24, horizon: "batch" })
- 05:40:45ok best path #9 · tolerance held · lowest solvent and energy per batch
- 05:40:46policy.evaluate({ plan: 9, stage: "bounded" })
- 05:40:46ok 7 writes permitted · 1 write requires human approval
- 05:40:47plc.write_setpoint({ tag: "MILL2.ENERGY", basis: "power+spectral" })
- 07:28:30ok Hegman on target · color strength on target · no re-mill
- 07:29:00viscosity.predict({ tank: "LD-3", basis: "inline rheology+solids" })
- 07:29:00ok two resin and one solvent addition predicted · stability clear
- 07:29:01plc.write_setpoint({ tag: "LD3.SOLVENT_DOSE", window: "formula" })
- 07:55:10ok viscosity on spec · no overshoot
- 07:56:00spectro.read_curve({ station: "TINT-2", standard: "STD-2210" })
- 07:56:01dispenser.write({ colorant: "B", basis: "spectral prediction", retint_limit: 1 })
- 08:10:12ok draw-down inside Delta-E tolerance · one retint remaining
- 08:10:13vision.stream({ cameras: 12, models: ["color_gloss", "hiding_power", "seed_foam", "fill_label"] })
- 08:21:48flag: seed · pail 0417 · attributed to filter cartridge F-2 loading
- 08:21:49defect.attribute({ event: "seed", cause: "filter.cartridge_F2" })
- 08:21:49ok filter_fill notified · cartridge change scheduled · fill held 40 s
- 08:21:52approval.request({ action: "retint.beyond_limit", reason: "tighter Delta-E on lowest-solvent path" })
- 08:24:02ok approved by the shift color-matcher · tolerance untouched · one bounded addition
- 08:24:03plc.write_setpoint({ tag: "FIL1.TARGET_WEIGHT", basis: "fill-weight+foam feedback" })
- 09:48:40ok pails on weight · no spills · labels verified
- 09:49:38mes.release_batch({ batch: "B-4471", genealogy: "full" })
- 09:50:36ok batch released · scenario complete
Reasoning trace
Goal, plan, thought, action, observation, exactly as the orchestrator would record it.
GoalDisperse batch B-4471 to Hegman fineness, let it down to visco…
Disperse batch B-4471 to Hegman fineness, let it down to viscosity spec, tint it inside Delta-E of standard STD-2210, filter and fill it to exact weight and release it with full genealogy.
PlanSimulate the whole batch on the twin first. Lead with fineness…
Simulate the whole batch on the twin first. Lead with fineness so the let-down gets the right mill base and the tint station gets the right color strength. Keep the customer tolerance and the VOC limit as hard constraints. Let the dispenser converge only inside the declared retint limit; hold anything beyond it for a human.
ThoughtThe standing practice grinds to a fixed time, lets down by fou…
The standing practice grinds to a fixed time, lets down by four additions and tints by draw-down loops. With live fineness and viscosity prediction and a spectral color-match model the batch can land on the first pass. The saving is rework, colorant and solvent, not tolerance: the customer standard is never a candidate for optimization.
Actiontwin.simulate(candidates=24) → path #9: Hegman on target in on…
twin.simulate(candidates=24) → path #9: Hegman on target in one grind, three let-down additions, one colorant pass, lowest predicted solvent and energy per batch, takt met.
ObservationPath #9 wants a second colorant addition beyond the declared r…
Path #9 wants a second colorant addition beyond the declared retint limit to tighten Delta-E further. The policy engine routes that single move to the shift color-matcher and permits the other seven writes.
ActionExecute path #9 at the bounded stage: mill energy, let-down do…
Execute path #9 at the bounded stage: mill energy, let-down dosing and the first colorant pass proceed; inspection runs continuously; the extra addition waits.
ObservationApproval granted at 08:24:02 with the tolerance untouched and …
Approval granted at 08:24:02 with the tolerance untouched and a tighter draw-down check. Two seeds were attributed to filter cartridge F-2 and Filter-and-Fill scheduled the change with a 40 second hold.
OutcomeScenario complete. The batch is released with raw-material lot…
Scenario complete. The batch is released with raw-material lots, grind profile, let-down moves, colorant additions, spectral curves, inspection outcomes, VOC and solvent use and the human decision in the genealogy. No measured plant result is claimed; this is the run the platform is designed to execute.
Guardrails
An agent that can move a setpoint needs a leash
Tinteon writes to production equipment in a chemical plant. Every capability is scoped, every write is policy-checked, every output is cited, and every action is written to an append-only audit log the plant owns.
- Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate, magnitude and retint limits, at the autonomy stage the plant has set.
- Standards and limits are read, never written. The customer color standard and its tolerance, the VOC and solvent limits under the plant's permit and the batch release decision stay with the quality system and the people who own it.
- Policy engine before every write. Autonomy stage, interlock state, product, formula, shift and operator presence are evaluated before a setpoint or a colorant addition moves.
- Grounded and cited. Every recommendation carries a citation to the formula, color standard, spec or procedure it relied on. Retrieval is tenant-isolated and permission-aware.
- Immutable audit log. Append-only, exportable and retained on the plant's own storage, aligned to ISO 9001, VOC and REACH and customer color-standard record-keeping.
- Hard fallback. If the edge node, the network or a model stops, the plant keeps running on its existing mill, dispenser and filling-line control and interlocks.
- Tenant and IP isolation. Formulas, color standards, raw-material data and tolerance models never cross a customer boundary. On-prem deployment available.
Assurance posture
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I | Cloud control plane | QUEUED Roadmap, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Roadmap, 6 to 12 months |
| ISO 9001 · VOC and REACH · customer color standards | Grounding and record-keeping | RUNNING Design basis for retrieval and the audit log |
| Per-tenant isolation | Data, memory, models | RUNNING Design rule |
| On-prem deployment | Formula-sensitive producers | RUNNING Design option |
Tinteon supports your quality and VOC records. It is not a certification and it does not replace your quality system or your permit.
Autonomy
Four stages, set per loop
A plant does not go from manual to bounded control in one step. Tinteon makes the stage explicit per loop, auditable and reversible at any time, and some decisions never leave the person.
| Stage | What the agent does | What the person does | When |
|---|---|---|---|
| Shadow | Predicts fineness, viscosity, Delta-E, hiding power, contamination and fill faults; writes nothing | Runs the plant as today; compares predictions to the lab, the spectrophotometer and PLC outcomes | First phase with every design partner |
| Assist | Recommends bounded mill, let-down, colorant, filtration and fill moves with the evidence | A formulator, color-matcher or quality manager approves or rejects each one | After accuracy is proven against the baseline |
| Bounded | Writes low-risk dispersion, tinting and inspection setpoints inside documented formula, tolerance, VOC, equipment and rollback limits | Approves anything above the limits; reviews the shift record | After the quality and ROI gates agreed up front |
| Exceptions | Escalates anything outside its envelope, any move against a customer standard or VOC limit, and release decisions | Always decides these; the agent never does | Permanent |
Assurance
Certification status
Stated plainly. Items on the roadmap are roadmap items.
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I | Cloud control plane | QUEUED Roadmap, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Roadmap, 6 to 12 months |
| Quality and VOC assurance packages | Design partners | QUEUED Roadmap, 6 to 12 months |
| ISO 9001, VOC and REACH, customer color standards | Grounding and records | RUNNING Design basis; not a certification of Tinteon |
| IP-safe deployment | Formulas, color standards, raw-material data | RUNNING Design rule; on-prem option |
OT safety
Failing safe is a design requirement
- Supervisory, not primary. Tinteon sits above existing mill, dispenser and filling-line control; it never replaces an interlock or a safety system.
- Standards and limits are read-only. Customer color standards, tolerances and VOC limits are cited and logged, never written.
- Release is human. The conformance agent assembles the genealogy and checks it against spec; a person releases the batch.
- Loss of Tinteon is loss of advice. The plant degrades to the way it runs today, not to a stop.
What leaves the plant, and when
| Data | Where it stays |
|---|---|
| Formulas, color standards, tolerance models | Tenant-scoped; on-prem option |
| Raw-material, pigment and colorant data | Tenant-scoped |
| Audit log and genealogy | The plant's own storage, exportable |
| Rare-fault and drift patterns | Federated, IP-isolated transfer across similar lines (planned, opt-in) |
Multi-agent handoff
Agents negotiate, they do not collide
Two agents will want the same actuator. The orchestrator arbitrates on the run goal, with the customer color standard, the VOC limit and a clean fill above everything, and the handoff is logged like any other step.
Contested move: filter cartridge change on the filling line
-
01yield_takt.request(skip change) SUCCEEDED0.2 s
Yield-and-Takt wants to defer the filter cartridge change to the shift break so the filling line stays on takt and the next color family starts on time.
-
02filter_fill.request(change now) SUCCEEDED0.2 s
Filter-and-Fill requires the change now because inspection attributed two seeds to the loaded cartridge. Contamination in a released pail is a customer complaint.
-
03orchestrator.arbitrate SUCCEEDED0.4 s
Product conformance outranks takt under every run goal. The cartridge change wins the actuator; the request to defer is logged with its score and the reason it lost.
-
04yield_takt.handoff(resequenced) SUCCEEDED80 s
Yield-and-Takt recovers the schedule by pulling the next batch's wash earlier and moving a lighter color family ahead. Takt is met without filling through a loaded cartridge.
Arbitration rules
- Run goal first. Every request is scored against the declared goal, not against the requesting agent's local objective.
- Conformance outranks everything. The customer color standard, the VOC limit and a clean fill are never optimization variables. A contaminated or off-color pail is a complaint; a takt miss is a schedule.
- Time-boxed ownership. An agent holds a contested actuator for a bounded window, then must re-justify.
- Everything is logged. The losing request, the score and the reason all appear in the run record.
- Deadlocks escalate to a human rather than resolving by timeout.
Enterprise
Standardize autonomy across the group
One policy model, one audit trail and one set of yield, rework, waste, solvent, energy and color benchmarks across every plant in the group, with each site's formulas, color standards and tolerance models kept private to that site.
- Multi-site plant-edge fleet with shared model governance
- Custom formula, color and tolerance models per site
- SSO and role-based access, named approvers (roadmap, 6 to 12 months)
- Model versioning, validation reports and rollback
- On-prem or private-cloud deployment
- SLAs and outcome-based components on the highest-value workflows
FAQ
Straight answers
The questions plant directors, formulators, color-matchers and quality managers ask in the first meeting.
Only at the autonomy stage your plant has set, and only to an explicit allow-list of low-risk loops inside documented limits. Every design partner starts in shadow mode, where Tinteon predicts and writes nothing. Assist mode follows, where a formulator or color-matcher approves each recommendation. Bounded autonomy on dispersion, tinting and inspection loops comes after the quality and ROI gates agreed up front.
They are not optimization variables. The customer standard and its tolerance, the VOC and solvent limits under your permit and the batch release decision stay with your quality procedures and your people. Tinteon reads them, cites them and writes every reading to an immutable audit log attached to the batch genealogy. It is grounded in ISO 9001, VOC and REACH and customer color standards; it is not a certification and does not replace your quality system.
Tinteon sits above your existing automation as a supervisory layer. If it stops, the plant keeps running on its current mill, dispenser and filling-line control and the interlocks it already has. A Tinteon outage degrades the plant to the way it runs today, not to a stop.
The first phase is shadow mode on one line: Tinteon reads your spectrophotometer, mill and dispenser history, inline rheology, lab results and MES while you run the plant as usual, and we measure its predictions against your lab, your draw-downs and PLC outcomes. Recommendations start when accuracy is proven against that baseline, and improve as plant-specific history and color-matcher corrections accumulate.
Formulas, color standards, tolerance models and raw-material data are tenant-scoped and never used to train another customer's models. Retrieval is multi-tenant isolated and permission-aware. Cross-plant learning, where a customer opts in, is federated and IP-isolated. On-prem deployment is available for producers protecting sensitive formulas.
You are, the same as with any control strategy. That is why every write is policy-checked, bounded, logged and reversible, every output carries a citation to the formula, standard or procedure it relied on, and anything above your threshold waits for a named approver. The audit log records the request, the reasoning, the limits applied and the human decision.
As a design partner, on one line, with one hard metric: Delta-E first-time-right rate and retints, re-mills and mill energy, solvent per batch and viscosity variance, or contamination and fill rejects. We instrument the line in shadow mode, measure the baseline, move to assist mode when accuracy is proven, and expand only when the number holds.
Full multi-module autonomy across the whole plant, long-tail integrations beyond the design partners' stacks, and self-serve onboarding. The first release is one wedge workflow, its connectors, the agent loop with human checkpoints, the review console and the assurance-grade quality and VOC audit log.
Get started
Get the security pack
The design posture, the data flows and the roadmap dates, written for a quality manager and an IT/OT lead.