Key takeaways ▼
by Ajay Kumar Govindaram
There’s a question I’ve started asking at every agentic AI demo I sit through, and it has a clean answer in every fab on earth: who is allowed to change the recipe? In a semiconductor factory, that was settled decades ago. A person doesn’t touch a production recipe because they feel confident. They touch it because they hold a qualification, the change passed management of change, and an out-of-control action plan told them exactly what’s permitted when a chart goes sideways. Authority is granted on evidence and revoked on evidence. Every time. Now put an autonomous agent in that same aisle, one that can triage a fault-detection alarm or nudge a run-to-run setpoint, and ask again. The fab already knows how to answer it. Most agent platforms simply haven’t been asked yet.
That gap is where I want to spend this article. I think the semiconductor industry is sitting on the best framework anyone has for governing agentic AI, and it predates the technology by forty years.
The Question Every Agentic Pilot Skips
Walk the exhibition floor at any industry event this year and you’ll hear the same pitch: an agent that watches your process data, finds the anomaly, and acts. The demos are good. The recommendations are often right. And then the pilot stalls in the same place every time, the moment someone in process engineering asks the uncomfortable question. When is this thing allowed to act on its own? Who signed off on that? What happens to its privileges when its behavior changes next quarter?
Silence.
Most agentic systems have no answer, because they were built to be smart, not to be governed. So the fab does the only safe thing it can and keeps a human on every single action. The agent becomes an expensive suggestion box, and the business case (the one that assumed some decisions would eventually run unattended) never closes.
Gartner has predicted that over 40% of agentic AI projects will be canceled by the end of 2027, pointing to escalating costs, unclear business value, and inadequate risk controls (Gartner, June 2025). In a fab, I’d argue the risk-control part of that list is most of the story. An ignored recommendation costs a few minutes. An unauthorized recipe change costs every wafer that runs before someone catches it, and that asymmetry is why “the model is accurate” was never going to be enough.
The Fab Already Solved This, Just Not for Software
Here’s the part that excited me when it clicked: the fab doesn’t have a gap here at all. It runs a mature, audited, boring-in-the-best-way system that settles exactly which actor may alter which parameter, under what circumstances, and backed by what evidence. We just never pointed it at software. Nobody thought to.
Think about what already governs a process engineer. Tool qualification establishes that a person or system is competent before they get near production. Statistical process control says, continuously, whether a process is behaving inside its limits. An out-of-control action plan specifies the exact response when it isn’t, including who may act and what they may do. Management of change gates any permanent modification behind review and sign-off. None of it trusts anyone because they seem reliable; it demands evidence, and it withdraws permission the moment the evidence turns.
An agent is just a new kind of operator. A fast one, a tireless one, one that reads more sensor channels than any human can hold in their head, but an operator all the same. And the fab already knows how to onboard an operator who hasn’t yet earned the right to act alone. So the design problem isn’t “how do we govern AI.” It’s “how do we enroll this new operator into the governance we already run,” and that reframing changes everything downstream.
Four Levels, and Nobody Starts at the Top
The practical core is an autonomy ladder. Every class of decision an agent might touch gets a level, and the levels are deliberately unglamorous.
At the first level, the agent observes. It reads the process, forms conclusions, and keeps them to itself for later comparison; nothing it thinks reaches a human yet. At the second, it recommends. Its calls surface to an engineer, who acts or ignores them, and every one of those responses becomes training signal and track record. At the third, it acts with approval: the agent proposes a specific action (a lot hold, a recipe tweak) and a qualified human confirms before it executes. At the fourth level, and only for decision classes that have earned it, the agent acts within limits. It executes on its own inside a tightly bounded envelope, and any move outside that envelope goes back to a human.
Notice what the ladder refuses to do. It never grants blanket autonomy. A single agent can sit at level four for a low-risk, high-frequency decision like sorting nuisance alarms from real ones, while staying at level two for anything that moves a setpoint on a critical layer. Authority is per decision class, not per agent, which is exactly how a fab already treats people. A technician certified on one tool set isn’t thereby certified on all of them.
Promotion Is Earned, With the Same Evidence a Human Would Need
What matters is how an agent moves up a rung, and the answer has to be evidence a quality engineer would accept, not a vendor’s confidence slide.
Three gates work well. The first is shadow-mode agreement: before an agent recommends anything to humans, it runs silently for a defined period, its conclusions are compared with what the engineers actually did, and it has to clear a minimum agreement threshold. The second is a minimum sample. You don’t qualify a tool on three runs, and you don’t promote an agent on thirty decisions; the sample has to be large enough that the agreement number means something. The third, and the one most AI teams miss, is a control chart on the agent’s own conduct that holds steady inside its limits.
That last gate deserves a beat. We’re used to running SPC on the process. The move here is to run SPC on the agent. Track its override rate, its false-hold rate, and the size of the recipe adjustments it proposes, and chart them over time the way you’d chart any process parameter. An agent whose conduct charts predictably, inside limits and trending the right way, is a candidate for promotion. An agent whose numbers are wandering has told you something important about itself before it ever touches a wafer.
I’ll admit why this gate won me over. In a prototype I built to stress-test the idea, I let an agent shadow a run-to-run loop, and the first sign of trouble wasn’t a bad recommendation. It was the agent’s own override rate drifting upward over about a week of data, slowly enough that I’d have missed it watching the dashboard by eye. The chart on the agent’s behavior caught the drift before I did. That’s when this stopped being a slide and became something I trusted. Not the model. The chart.
Demotion Is Automatic, and That Is the Whole Point
Promotion gets the headlines. Demotion is what makes the system safe enough to deploy.
The moment one of the agent’s behavior metrics crosses a control limit, or a Western Electric run rule fires on it, the agent gives up a rung of authority on its own. Not after a review meeting. Not after an incident write-up. Before the next decision executes. The agent that was acting within limits this morning is back to recommending this afternoon, because its override rate climbed through a boundary, and a human is quietly back in the loop until it re-earns the rung.
This is the fab instinct software culture lacks. An interlock doesn’t debate; it trips. A factory’s whole safety philosophy rests on automatic, pre-agreed responses to out-of-bounds conditions, because the alternative (counting on someone to notice and react in time) has a body count in industries less forgiving than ours. Porting that instinct to agent governance is, to me, the most valuable thing the semiconductor world can teach the people building these systems.
The Record Has to Satisfy Audit, Not Just Engineering
Every action, and every deliberate choice not to act, gets logged with the evidence behind it: what the agent saw, which rung it was on, what it was therefore allowed to do, and what it did. That isn’t bureaucratic overhead. It’s the same explainability advanced process control already owes a quality team, extended to a new actor.
The payoff is that an agent governed this way slots into the systems a fab already runs. Change control sees every permanent adjustment, along with who or what authorized it, in the same queue where it already reviews engineering changes from people. Quality can reconstruct any decision. Audit gets a trail that looks familiar, because it was designed to. The agent isn’t a special case bolted onto the side of the quality system; it lives inside it.
What Breaks in a Brownfield 200mm Fab
I’d be selling something if I pretended this drops cleanly into every facility. It doesn’t, and it strains exactly where you’d expect.
The autonomy ladder assumes you can measure the agent’s behavior well enough to chart it, which assumes tool connectivity and data quality that a modern 300mm line mostly has and an older 200mm or mixed brownfield line often doesn’t. If you can’t get clean, time-aligned data off a tool, you can’t run SPC on an agent acting through that tool, and that agent can’t safely climb past recommending. That’s not a failure of the framework. It’s the framework telling you the truth: authority is capped by observability, for software exactly as for people. A fab that wants more autonomous agents now has a concrete reason to finish the connectivity work it’s been deferring.
The Industry Is Already Moving This Way
This isn’t only my whiteboard thesis. Watch where the serious fab-data players are going. When PDF Solutions introduced Exensio Aurora in September 2026, the platform was built from the start to run agentic AI across manufacturing operations at petabyte scale, on a contextualized, trustworthy data layer. The order in that design is the quiet confirmation: get the trustworthy foundation right first, then let autonomous AI operate on top of it. Authority rides on evidence, and the same argument is now coming from the tooling side.
The fabs that win the agentic era won’t be the ones that bought the smartest agent. They’ll be the ones that already knew how to grant and revoke authority on evidence, and simply enrolled a new kind of operator into a discipline they’ve trusted for forty years. The recipe question has an answer. It always has. We just have to make the software earn it.
I’d love to hear how teams further down this path are drawing the line, especially which decision classes you’ve been willing to let an agent hold on its own, and what made you comfortable enough to let it.
* * *
Ajay Kumar Govindaram is a Data and AI Architect who works on real-time streaming systems, agentic AI architecture, and data platforms for semiconductor and high-tech companies. His background spans engineering in fabs and fabless design companies as well as cloud-native architecture, and he applies manufacturing and chip-design discipline to production AI systems. He is the author of Yield-Grade Data (2026) and is authoring Fab-Grade AI: The SIGNOFF Method for Production Agentic Systems, forthcoming and under review with a major technical publisher. He has published more than 30 technical articles and speaks at semiconductor and agentic AI conferences. Views are his own; examples are illustrative or drawn from publicly available sources.
The views, thoughts, and opinions expressed belong solely to the speaker, and not to the speaker’s employer, organization, committee or any other group or individual.
Also Read:
Moving Beyond AI-Assisted Design – Agentrys Shows the Way with Agentic Loop Engineering
ChipAgents Expands AI Across Chip Design. The Test Is Faster, Verified Results
Rethinking Phase Jitter: An Algorithmic Approach to Signal Integrity
Share this post via: