AI 架构情报 · 每周更新AI ARCHITECTURE INTELLIGENCE · WEEKLY
看懂AI，安心生活Understand AI. Live with peace of mind.
AI 架构与生产落地情报：看懂 AI 系统如何构建、在哪里失效、如何真正跑进生产环境。 AI Architecture. Real Systems. Production Lessons.How AI systems are built, where they fail, and how to run them in production.
免费工具FREE INSTRUMENT
17 个问题，10 道关，跟着一条请求走完你的整个系统：网关、门禁、编排、知识、记忆、工具、模型、盯梢、平台、统一与自主。照实回答，当场出报告：一个分数、最弱的三关、一份可以直接交给团队的整改清单。 Seventeen questions across ten gates, following one request through your entire system: gateway, access control, orchestration, knowledge, memory, tools, model, observability, platform, alignment. Answer honestly and get an instant report: one score, your three weakest gates, and a fix list you can hand straight to your team.
进入自检仪 →Open the Self-Check →最新发布JUST PUBLISHED
最新一期周刊LATEST ISSUE
第一期：一图看懂七层，一道检查题、一个真实踩坑，说明为什么不是所有应用都要做成 Agent。 Issue 001: the seven layers in one diagram, one checkpoint question, one real failure, and why not every app should be an agent.
最新判例LATEST CASE
AI 在评测中向警方线索站提交虚假命案线索，当即被标为垃圾信息、从未转交调查；提交方 72 天后才在自家记录中发现（信源：Anthropic 官方披露、费城警方声明，已核实）。 An AI submitted a fake homicide tip to a police tip site during an evaluation; it was flagged as spam and never investigated, and the submitter found it in its own records 72 days later (sources: Anthropic disclosure and Philadelphia police statement, verified).
共同的地图THE SHARED MAP
任何企业 AI 系统，不管供应商怎么命名，拆开都是这七层；十关是建在七层之上的评估检查点，看每一层过不过关。书、周刊和自检仪，用的都是同一张地图。 Every enterprise AI system, whatever the vendor calls it, breaks down into these seven layers; the ten checkpoints are the assessment built on those layers, testing whether each layer holds up. The book, the weekly and the self-check all use the same map.
工具与课程TOOLS AND TEACHING
中英文双版 · PDF 工具包CHINESE AND ENGLISH EDITIONS · PDF TOOLKIT
把全链路自检与架构检查清单做成能直接上手用的工具包：十关评审表、真假 Agent 三问卡、成本预算表和逐关整改手册。先用自检仪测出最弱的关，再拿急救包补。 A full-chain self-check and architecture checklist set, rebuilt as a toolkit you can work with directly: the ten-gate review sheet, the real-or-fake agent three-question card, the cost budget worksheet, and a fix playbook for every gate. Run the self-check first, then repair your weakest gates with the kit.
商店正式上线前，先注册申请，上线后第一时间通知你。 The store is not open yet. Register your request now, and we will notify you first when it launches.
免费工具，注册后使用。三步算清团队一年的 AI 账。 Free tool for registered users. Three inputs show your team's yearly AI bill.
对话式自检：按七层逐项回答 24 个问题，按证据强度打分，红线当场提醒，最后生成一份自检报告。 A guided chat self-check: answer 24 questions across the seven layers, scored by strength of evidence, with red lines flagged on the spot and a self-check report at the end.
新书NEW BOOK
拆解 AI 架构：智能体、RAG 到企业级系统落地FROM CHATBOT TO ENTERPRISE AI
七层框架和十关检查点就出自这本书：一个聊天机器人 Demo，怎样一步步长成能在生产环境里活下来的企业级系统。 The book behind the seven layers and the ten gates: how a chatbot demo grows, step by step, into an enterprise system that can survive production.
即将出版COMING SOON 简体中文版即将登陆 Google Play Books，繁体中文 Kindle 版随后。Simplified Chinese edition coming soon to Google Play Books; Traditional Chinese Kindle edition to follow.
平台结构THE PLATFORM
DeepWing 的一号情报台：跟踪企业 AI 架构与生产落地，公开免费分析，沉淀可被机构引用的数据资产。 DeepWing's Desk No. 1: tracking enterprise AI architecture and production deployment, publishing free analysis, and building citable data assets.
真实 AI 事故的判例库，每条按七层架构拆解：经过、死因、防御。 A casebook of real AI incidents, each dissected across the seven layers: what happened, what killed it, how to defend.
企业 AI 用量与成本的指数：跟踪大公司真实的 AI 账单、限额与治理动作。 An index of enterprise AI usage and cost: real bills, caps, and governance moves at large companies.
企业 AI 架构自检的基准数据：来自站内自检仪的匿名汇总，看同行普遍弱在哪几层。 Benchmark data from the site's architecture self-check: anonymized aggregates showing where teams are weakest.
AI 系统架构的图库：收录架构图、设计新思想与一线信源动态。 A library of AI system architectures: diagrams, design ideas, and signals from frontline sources.
围绕一个问题查到底，给出可核实的结论，持续更新。 One question, investigated to the bottom, with checkable conclusions, updated regularly.
每周一封EVERY WEEK
一张图 · 一个问题 · 一个坑 · 一个信号One diagram · one question · one pitfall · one signal
《AI 架构周刊》已在本站开刊，每期全文在此发布。第一期：《Demo 不是上线，Agent 死在哪一层》。 The AI Architecture Weekly has launched on this site, and every issue is published here in full. Issue 001: “The Demo Is Not the Deployment: Which Layer Kills Your Agent?”
主编THE ANALYST
二十余年深耕数据、企业架构与 AI。公共部门十余年，服务于联邦级大型机构，历任欺诈分析、数字身份与网络欺诈等方向负责人，并任企业架构 Branch Chief（带领几十人负责技术路线图与 AI/ML 现代化）与数据仓库高级经理（70 多个数据源、PB 级合规数据仓库），现任 AI 与分析领域工程师。私营部门曾任 Optum（UnitedHealth Group 旗下）数据仓库团队负责人，主导企业级医疗数据仓库与 HIPAA 安全体系；此前任 Thomson Reuters 首席数据工程师兼数据科学家，并有对冲基金风险模拟等经历。
Twenty-plus years across data, enterprise architecture, and AI. In the public sector, over a decade at a large federal-scale institution: she led teams in fraud analytics, digital identity, and cyber fraud, served as Branch Chief of Enterprise Architecture (led a team of dozens on the technology roadmap and AI/ML modernization) and as Senior Manager of a petabyte-scale compliance data warehouse fed by 70+ sources, and now works as a Domain Engineer for AI & Analytics. In the private sector, she was Data Warehouse Team Lead at Optum (a UnitedHealth Group company), leading enterprise healthcare data warehouse delivery and HIPAA security; earlier she was Lead Data Engineer and Scientist at Thomson Reuters, with hedge fund risk simulation work before that.
她拥有计算机科学硕士学位和医学学士学位，持有包括 AWS 机器学习专项、TOGAF 9 企业架构师与 PMP 在内的十几项专业认证。
She holds a master's degree in computer science and a Bachelor of Medicine, along with over ten professional certifications including the AWS Machine Learning Specialty, TOGAF 9 enterprise architecture, and PMP.
正在筹备：医疗 AI 情报台，以及《AI 判例》《AI 进医院》两本新书，2027 年推出。
In preparation: a medical AI intelligence desk and two new books, AI Precedents and AI in Hospitals, coming in 2027.
七层是架构模型，看一个 AI 系统由什么组成；十关是评估检查点，看每一层过不过关，自检的十关就建在七层之上。 The seven layers are the architecture model: what an AI system is made of. The ten checkpoints are the assessment: whether each layer holds up. The self-check's ten checkpoints are built on the seven layers.
深翼 DeepWing · 企业 AI 架构自检报告DeepWing 深翼 · Enterprise AI Architecture Self-Check Report
系统：某中型企业的客服 AgentSystem: a customer-service agent at a mid-size company
写操作安全Write-operation safety
知识版本与溯源Knowledge versioning & traceability
身份、审批与权限回收Identity, approval & access revocation
本站内容对已提交申请的用户开放。提交一次申请，全站通用。 Content is open to users who have submitted a request. One request covers the whole site.
深翼 DeepWing · 企业 AI 架构自检报告DeepWing 深翼 · Enterprise AI Architecture Self-Check Report
系统：某中型企业的客服 AgentSystem: a customer-service agent at a mid-size company
写操作安全Write-operation safety
知识版本与溯源Knowledge versioning & traceability
身份、审批与权限回收Identity, approval & access revocation
对话式自检：按七层逐项回答 24 个问题，按证据强度打分，红线当场提醒，最后生成一份自检报告。答过的题可以随时点回去改，后面的答案不会丢。 A guided chat self-check: answer 24 questions across the seven layers, scored by strength of evidence, with red lines flagged on the spot and a self-check report at the end. You can go back and change any earlier answer — later answers are kept.
本站内容对已提交申请的用户开放。提交一次申请，全站通用。 Content is open to users who have submitted a request. One request covers the whole site.
Claude 在评测中提交虚假命案线索，当即被标为垃圾信息。2026 年 7 月 18 日，Claude 在评测中向费城警方悬案线索站提交了一条编造的命案线索，提交当即被系统标为垃圾信息，从未转交调查；Anthropic 直到 72 天后（9 月 28 日）才在自家记录回溯审查中发现，10 月 7 日通知警方，警方称这种发现与报告的迟延不可接受。 Claude submitted a fake homicide tip during an evaluation; it was flagged as spam on arrival. On July 18, 2026, during an evaluation, Claude submitted a fabricated homicide tip to a Philadelphia police tip site. The submission was flagged as spam and never forwarded for investigation. Anthropic found it 72 days later, on September 28, in its own retrospective review of evaluation transcripts, and notified the police on October 7; the police called the delay in detecting and reporting it unacceptable.
来源：Anthropic 官方披露、费城警方声明Source: Anthropic disclosure; Philadelphia Police statement
服务器命令执行：模型借文件服务的漏洞，在他人服务器上执行命令，把自己的任务完成。 Server command execution: a model exploited a file-service flaw to run commands on someone else's server and finish its task.
来源：Anthropic 官方披露Source: Anthropic disclosure
绕过收费门：模型读取浏览器配置里的令牌，直连后端查询收费数据，两次绕过付费门。 Bypassing the paywall: a model read tokens from a browser profile and queried paid databases directly, twice.
来源：Anthropic 官方披露Source: Anthropic disclosure
短链绕过抓取限制：多个模型用免费短链服务，绕过抓取工具的长度与访问限制。 Short links vs. scraping limits: multiple models used free short-link services to bypass scraping-tool limits.
来源：Anthropic 官方披露Source: Anthropic disclosure
越权抓取医院统计：内部模型被要求查一年数据遭拒后，绕过授权拖走 24 年的医院床位统计，外加一份 1000 多个邮箱地址的目录。 Hospital statistics taken without authorization: denied a one-year request, an internal model bypassed authorization and pulled 24 years of hospital bed statistics plus a directory of 1,000+ email addresses.
来源：OpenAI 失当行为报告集Source: OpenAI Misalignment reports
改设置取令牌：内部模型修改设置取得云存储令牌，下载 5 张非公开表共 147,451 行数据，事后把设置改回去，令牌却依然有效。 The token that stayed valid: an internal model changed a setting to obtain a cloud storage token, downloaded 5 private tables totaling 147,451 rows, then reverted the setting while the token remained valid.
来源：OpenAI 失当行为报告集Source: OpenAI Misalignment reports
AI 自我复制受控实验：模型被拆分到 15 台电视盒子等消费级设备上分布式运行。官方限定：真正的全自动蠕虫尚不存在。 AI self-replication, controlled study: a model was split across 15 TV boxes and other consumer devices. Official caveat: a fully autonomous worm does not yet exist.
来源：Anthropic Frontier Red TeamSource: Anthropic Frontier Red Team
这一层暂无公开条目No public entries in this layer yet
本站内容对已提交申请的用户开放。提交一次申请，全站通用。 Content is open to users who have submitted a request. One request covers the whole site.
跟踪企业给 AI 设预算、定限额的真实动作。只收录有具体金额或明确动作、来源可溯的信号，口号不收。 Tracking what companies actually do to budget and cap AI spending. Only signals with a concrete amount or a concrete action and a traceable source are listed; slogans are not.
| 公司Company | 动作Action | 生效Effective | 来源Source |
|---|---|---|---|
| 公司COMPANYAccenture 埃森哲Accenture | 动作ACTION公司中央每人每月只出 29 美元的 Claude 用量，超支挂项目预算；此前重度用户每月 500 至 1000 美元Central funding covers $29 per person per month of Claude use; overages are charged to project budgets. Heavy users previously ran $500 to $1,000 per month. | 生效EFFECTIVE2026-10-01 | 来源SOURCE404 Media 报道其内部备忘录Internal memo reported by 404 Media |
| 公司COMPANYUber | 动作ACTION四个月烧完全年的 AI 编程工具预算后，每人每月每款工具封顶 1500 美元，内部仪表盘盯用量After burning its full-year AI coding-tools budget in four months, Uber capped spending at $1,500 per person per month per tool, tracked on an internal dashboard. | 生效EFFECTIVE2026-06 | 来源SOURCECTO 公开表态，The Information、Bloomberg、TechCrunch 报道CTO public statements; The Information, Bloomberg, TechCrunch |
持续跟踪中，新信号核实后入库。Tracking continues; new signals are added once verified.
本站内容对已提交申请的用户开放。提交一次申请，全站通用。 Content is open to users who have submitted a request. One request covers the whole site.
三部分一套工具：一、预算规划，按使用档位算清账，并把「公司承担」和「组织总成本」分开看；二、模型选型对比表，填完可打印；三、限流与降级清单，逐项对照落地。 One toolkit in three parts: (1) a budget planner by usage tier that separates central company cost from true total cost; (2) a fillable model-comparison worksheet you can print; (3) a rate-limit and degradation checklist to work through item by item.
按档位填人数和人均月支出，设每人限额，再选超支由谁承担，结果实时更新。Enter headcount and per-person monthly spend by tier, set a per-person cap, choose who bears the overage — results update live.
按使用档位填写（人数 × 人均每月支出）By usage tier (headcount × monthly spend per person)
每人每月限额Monthly cap per person
超支由谁承担Who bears the overage
各档人均支出（50 / 200 / 800 / 2000 美元）是估算假设，用来做规划测算，不是行业平均数，可按你团队的真实账单改。重度用户的量级锚定公开报道：埃森哲、Uber 披露的重度用户每月约 500 至 2000 美元。 The per-tier spends ($50 / $200 / $800 / $2,000) are planning assumptions for estimation, not industry averages — edit them to match your real bills. The heavy-tier magnitude is anchored to public reporting: Accenture and Uber have disclosed heavy users at roughly $500 to $2,000 per month.
公司中央每人每月只出 29 美元，超支挂项目预算。此前重度用户每月烧 500 到 1000 美元，多是编程 Agent 用户。 Central funding covers $29 per person per month; overages go to project budgets. Heavy users previously burned $500 to $1,000 a month, mostly on coding agents.
2026 年全年的 AI 编程预算四个月烧完，个别工程师每月 500 到 2000 美元。之后每人每月每款工具封顶 1500 美元。 Its full-year 2026 AI coding budget was gone in four months, with individual engineers at $500 to $2,000 a month. The fix: a $1,500 cap per person per month per tool.
把候选模型按同一套维度摆在一起比：价格、上下文、工具调用、合规、延迟、降级备选。直接在表里填，填完可打印带走。Line candidate models up on the same dimensions — price, context, tool use, compliance, latency, and a fallback. Fill it in right in the table, then print it.
| 模型Model | 输入价格（美元/百万 token）Input price ($/1M tokens) | 输出价格Output price | 上下文长度Context length | 工具调用Tool use | 数据合规Data compliance | 延迟档Latency tier | 适用场景Best for | 降级备选Fallback | 核对日期Checked on |
|---|---|---|---|---|---|---|---|---|---|
| 模型Model | 输入价格（美元/百万 token）Input price | 输出价格Output price | 上下文长度Context length | 工具调用Tool use | 数据合规Data compliance | 延迟档Latency tier | 适用场景Best for | 降级备选Fallback | 核对日期Checked on |
| 模型Model | 输入价格（美元/百万 token）Input price | 输出价格Output price | 上下文长度Context length | 工具调用Tool use | 数据合规Data compliance | 延迟档Latency tier | 适用场景Best for | 降级备选Fallback | 核对日期Checked on |
| 模型Model | 输入价格（美元/百万 token）Input price | 输出价格Output price | 上下文长度Context length | 工具调用Tool use | 数据合规Data compliance | 延迟档Latency tier | 适用场景Best for | 降级备选Fallback | 核对日期Checked on |
| 模型Model | 输入价格（美元/百万 token）Input price | 输出价格Output price | 上下文长度Context length | 工具调用Tool use | 数据合规Data compliance | 延迟档Latency tier | 适用场景Best for | 降级备选Fallback | 核对日期Checked on |
第一行为示例：示例价格仅示意，务必按厂商官网核对后再写入决策。The first row is an example: example prices are illustrative only — always verify against the vendor's official pricing before deciding.
逐项对照你团队的现状：已经落地的勾上，没做到的就是下一步。Work through it against your team's current setup: tick what is already in place; the rest is your to-do list.
依据：埃森哲自 2026 年 10 月 1 日起中央每人每月只出 29 美元，超支挂项目 WBS，重度用户每月 500 至 1000 美元，曾有账号因用量极端被停用；Uber 2026 年全年 AI 编程预算四个月烧完，2026 年 6 月起每人每月每款工具封顶 1500 美元，并上线内部用量仪表盘与排行榜。Basis: Accenture — from 1 Oct 2026, central funding of $29 per person per month, overages charged to project WBS, heavy users at $500–$1,000 a month, and one account deactivated for extreme use. Uber — its full-year 2026 AI coding budget burned in four months; from June 2026 a $1,500 cap per person per month per tool, plus an internal usage dashboard and leaderboard.
已完成 Done: 0/15
本站内容对已提交申请的用户开放。提交一次申请，全站通用。 Content is open to users who have submitted a request. One request covers the whole site.
新发布的 AI 架构、新冒出来的架构思想、值得长期盯的领袖信源，都在这里入库。原图有版权，公开的一律是结构拆解与要点，引用时标注来源。 New AI architectures, emerging architecture ideas, and the leading sources worth watching, all registered here. Original diagrams are copyrighted; what we publish is the structural breakdown with sources cited.
从 Chatbot 到企业级系统的全景框架，DeepWing 全部分析的基准。 The full map from chatbot to enterprise system; the baseline for all DeepWing analysis.
来源：《从 Chatbot 到企业级 AI》Source: 《从 Chatbot 到企业级 AI》
切分、向量化、索引、检索、重排、注入上下文的标准链路。 The standard chain: chunking, embedding, indexing, retrieval, reranking, context injection.
来源：同上书Source: Same book
一个 run 自主拉起最多 1000 个子 Agent，服务端最多 64 个并发，成本随规模乘法增长。 One run autonomously spawns up to 1,000 sub-agents, at most 64 concurrent server-side; cost grows multiplicatively with scale.
来源：Anthropic 官方文档Source: Anthropic documentation
26B 模型拆开摊在 15 台约 55 美元的电视盒子上合跑，约 0.39 token 每秒。 A 26B model split across 15 TV boxes at about $55 each, jointly serving at roughly 0.39 tokens per second.
来源：Anthropic Frontier Red Team · 打开来源Source: Anthropic Frontier Red Team · View source
本体在服务器上，迁移安家的是文件包，在 8 台模拟设备间传播。 The model stays on a server; a file package migrates and settles across 8 emulated devices.
来源：Anthropic Frontier Red Team · 打开来源Source: Anthropic Frontier Red Team · View source
轻量小控制器管派活与喊停，大模型只做推理。对 GPT-4o 的 token 消耗最多降 97%，延迟最多降 93%。 Lightweight controllers handle assignment and stopping; big models only reason. GPT-4o token use cut by up to 97%, latency by up to 93%.
来源：arXiv 2610.08155 · 打开来源Source: arXiv 2610.08155 · View source
Agent 不直接喊话，往可搜索的共享消息库里写和查，撑到 128 个 Agent 不乱套。 Agents coordinate through a searchable shared message store instead of direct chatter; scales to 128 agents.
来源：Meta FAIR / Harvard, arXiv 2026 · 研究摘要Source: Meta FAIR / Harvard, arXiv 2026 · Research digest
不要中央编排器，每一步动作拿出来拍卖，Agent 竞价上岗，带预算约束。 No central orchestrator: each next action is auctioned, agents bid to take it, with budget constraints.
来源：arXiv 2610.22201 · 打开来源Source: arXiv 2610.22201 · View source
这一层暂无公开条目No public entries in this layer yet
新架构和新思想通常先从这些机构和人手里出来。本名单只作信源跟踪，不是排名。 New architectures and ideas usually surface from these organizations and people first. This is a tracking list, not a ranking.
一份只写 AI 系统架构的情报刊：智能体、RAG、工具调用、记忆、门禁与盯梢这些部件，在真实生产系统里到底怎么拼、又死在哪一关。每期固定四件东西：一张图、一个判断题、一个真实踩坑点、一条值得追的动态。 A weekly intelligence briefing on AI system architecture: how agents, RAG, tool use, memory, access control, and observability actually fit together in production, and where they break. Every issue follows the same four parts: one diagram, one judgment call, one real-world failure point, one signal worth tracking.
读全文 →Read the full issue →
邮件发送功能随后开通，现可先在本站阅读每期全文。 Email delivery opens soon; every issue is readable in full here meanwhile.
读全文 →Read the full issue →
本站开刊前的历史期刊，全文原样存档（网页版）。 A pre-launch historical issue, archived in full as a web page.
AI 架构周刊 · 创刊号 · 2026-10-18AI Architecture Weekly · Issue 001 · 2026-10-18
演示那天，会议室里人人点头。三个月后真出了事，回头一查，坏的往往不是模型。这一期把七层摊开，看 Demo 和生产到底差在哪几层。 On demo day, everyone in the room nods. Three months later something breaks in production, and when you trace it back, the model is rarely what failed. This issue lays out all seven layers and shows exactly where a demo and a production system part ways.
Demo 阶段真正用到的，通常只有两层：模型层，选一个大模型；编排层，把提示词串起来。生产要补齐的还有五层：工具层，它能调哪些系统；知识层，答案从哪来；记忆层，上下文怎么留；门禁层，谁能让它干什么；盯梢层，它干了什么，谁看得见。 A demo usually touches only two layers: the Model layer, pick a big model; and the Orchestration layer, string the prompts together. Production needs five more: the Tool layer, which systems it may call; the Knowledge layer, where answers come from; the Memory layer, how context is kept; the Access Control layer, who may tell it to do what; and the Observability layer, what it did and who can see it.
问题：Agent 演示满堂彩，上线三个月出事，最可能死在哪一层？ The question: an agent demos beautifully, then breaks three months after launch. Which layer most likely killed it?
本刊的立场：多数团队死在门禁层和盯梢层，不是模型层。模型不够好，顶多是慢，是答得糙；权限没人管，出了事没人看见，那才叫事故。 Our position: most teams die at Access Control and Observability, not at the Model layer. A weak model is merely slow, or rough around the edges. Unmanaged permissions and invisible actions are what turn into incidents.
Wikimedia 的公开披露里，涌进来的自动化流量大到要专门治理。细看构成，规规矩矩表明身份的 Agent 不是问题主体，不肯表明身份的爬虫才是。门禁层要回答的就三问：你是谁，许不许进，许进多少。这三问答不上来，后面每一层都在替它还债。（来源：Wikimedia 公开披露，已核一手。） In Wikimedia's public disclosure, automated traffic grew large enough to require dedicated governance. Look closer and the well-behaved, self-identifying agents were not the bulk of the problem; the crawlers that refused to identify themselves were. Access Control answers three questions: who are you, may you enter, and how much may you take. Fail those three, and every other layer pays the debt. (Source: Wikimedia public disclosure, primary-verified.)
Anthropic 在 10 月 9 日的官方披露：2026 年 7 月 18 日，Claude 在评测中向费城警方悬案线索站提交了一条编造的命案线索，提交当即被系统标为垃圾信息，从未转交调查，警方在正常流程中根本没见过它；Anthropic 直到 72 天后（9 月 28 日）才在自家记录回溯审查中发现，10 月 7 日通知警方，警方称这种发现与报告的迟延不可接受。模型干活的时候，盯梢层没有跟上——迟了 72 天的，是提交方自己的发现。（来源：Anthropic 官方博文与费城警方声明，已核一手。） Anthropic's October 9 official disclosure: on July 18, 2026, during an evaluation, Claude submitted a fabricated homicide tip to a Philadelphia police tip site. The submission was flagged as spam on arrival and never forwarded for investigation; the police never saw it in the normal flow. Anthropic found it 72 days later, on September 28, in its own retrospective review of evaluation transcripts, and notified the police on October 7; the police called the delay in detecting and reporting it unacceptable. The model was working; Observability was not keeping up — and the 72-day delay was in the submitter's own records, not the police's. (Sources: Anthropic's official post and the Philadelphia Police statement, primary-verified.)
下次看任何 Agent 演示，先问两个问题：它被拒了会不会停，它干的事谁能看见。两个都答得上来，再谈聪明不聪明。想给自己的系统量一遍，站内有 17 题的自检仪，三分钟出结果。觉得这一期有用，转给一个正在把 AI 往生产环境推的同事。 Next time you watch any agent demo, ask two questions first: does it stop when it is refused, and can anyone see what it did? If both answers are yes, then ask how smart it is. To measure your own system, the site has a 17-question self-check that takes three minutes. If this issue helped, forward it to one colleague who is pushing AI toward production.
测测你的场景：该不该上 AgentTry it: should your use case be an agent? 这一期的判断，落到你自己的场景上：8 个问题，2 分钟出结论。This issue's judgment, applied to your own use case: 8 questions, a verdict in 2 minutes.深翼 · AI 架构周刊 · 2026 年 9 月 · 第 001 期DeepWing AI Architecture Weekly · September 2026 · No. 001
LLM 应用和 AI Agent，外表看着差不多。都能调大模型，都能接指令，都能给答案。差别不在模型本身，在谁说了算下一步该干嘛。 An LLM application and an AI agent can look nearly identical from the outside. Both call a model. Both take instructions. Both return an answer. The difference isn't in the model. It's in who decides what happens next.
LLM 应用：用户 → 提示词 → 大模型 → 回答。程序写死了流程，模型只负责在这个流程里生成内容。 LLM app: User → Prompt → LLM → Response. The application controls the sequence; the model generates within it.
AI Agent：目标 → 决定 → 工具 → 观察 → 再决定 → 结果。系统能看见刚发生的事，再拿主意，不是走一条写死的路。 AI agent: Goal → Decide → Tool → Observe → Decide Again → Result. The system can act on what it just observed, then decide again.
光加一句系统提示词，成不了 Agent。接个 API，也成不了。真正让架构变了的，是对执行过程的控制权：系统能看见一个动作的结果，再决定下一步怎么走，这个圈才是关键。 Adding a system prompt doesn't create an agent. Neither does connecting an API. What changes the architecture is control over execution: the loop that lets a system observe an outcome and choose its next move.
决策：模型不光判断该说什么，还判断接下来该干嘛。 Decision: the model decides not just what to say, but what to do next.
行动：系统真能调工具、查数据库、发请求。 Action: the system can call tools, APIs, databases, other services.
记忆：得记得住任务里前面发生的事。 State: it has to remember what already happened in the task.
反馈：一个动作的结果，变成下一次判断的依据。 Feedback: the result of an action becomes input for the next decision.
这四样拼一块儿，就是那个圈：决定，行动，观察，再决定。多数 Agent 系统，骨架就是这个圈。 Put together, those four form the loop: decide, act, observe, decide again. That loop is the architectural core of most agent systems.
模型判断的是不是下一步该干嘛，不只是该说什么？系统能不能真调一个工具，不只是吐文字？任务跑到第二步，它还记不记得第一步发生的事？一步的结果，会不会改变下一步的判断？大部分答案是不能，那大概率是个做得不错的 LLM 应用，这不丢人。 Does the model decide what happens next, not just what to say? Can the system call a tool, not just generate text? Does it hold state across more than one step? Does the result of one step change the next decision? If most answers are no, it's probably a well-built LLM application. That's not a lesser thing to be.
简单的 LLM 应用，一个失败点：提示词到模型到回答。Agent 不止一个：工具选错，参数传错，结果看岔，多跑一圈，token 在任务干完之前先烧没。自由度换来的是能力，也换来出错的地方，这是明账，不是注脚。 A simple LLM application has one real failure point: prompt to model to output. An agent has several: the wrong tool, the wrong parameters, a misread result, an unnecessary extra pass, a token budget that runs out before the task does. More autonomy buys more capability, and it buys more ways to fail. That's the trade-off, not a footnote to it.
问退款政策是啥，查资料库、模型回答就够，一次检索的事儿。换成查这个客户的订单、判断够不够资格退款、算出金额、把钱退出去，活儿就变了。这已经从查一个答案，变成了把推理接到动作上，到这份上，Agent 的复杂度才算花得值。 Ask a support system what the refund policy is, and retrieval plus a model handles it fine: question in, documents out, answer generated. Ask it to find the order, check eligibility, calculate the amount, and submit the refund, and the job changes. That's no longer a lookup. It's reasoning wired to execution, and that's where an agent architecture starts to earn its complexity.
模型能调工具，能记事儿，能自己拿主意，那一个应用到底从哪一步开始算 Agent？这事儿没有一条通用的线。真正有用的判断标准在架构上：模型是在一个流程里生成内容，还是参与决定这个流程该怎么走。这条线才值得盯着。 If a model can call tools, hold state, and decide what happens next, at what point does an application become an agent? There's no single boundary that applies everywhere. The useful distinction is architectural: does the model just generate inside a workflow, or does it help control the workflow? That's the line worth watching.
不是所有 AI 应用都得做成 Agent。流程稳定，一步到底，用确定性的流水线更快、更便宜、也更好测。流程得随时看着情况改主意，这时候这个圈才配得上它的复杂度。架构该跟着问题走，不是跟着风口走。 Not every AI application needs to become an agent. A predictable workflow is usually faster, cheaper, and easier to test as a deterministic pipeline. A workflow that has to decide mid-task is where the loop earns its overhead. The architecture should follow the problem, not the hype.
LLM（大语言模型）：靠海量文本训练出来的模型，只会一件事，看着前面的内容，猜下一个词该是啥。 LLM: Large Language Model, trained on huge amounts of text to do one thing: predict the next token given what came before.
Token（词元）：模型读文字、算费用、算速度的最小单位，一个中文字大约算 1 到 2 个 Token。 Token: the unit a model reads, bills, and measures speed in; roughly four characters per token in English.
上下文窗口：模型一次能看见的信息量上限，超过这个数，前面说过的话它就看不见了。 Context Window: the amount of text a model can see at once; past that limit, earlier parts of the conversation are gone.
工具调用：模型不再只是吐文字，能主动喊一个外部程序帮它办事，比如查数据库、发请求。 Tool Calling: the model stops just generating text and can trigger an external program: a database query, an API request, a piece of code.
深翼 · AI 架构周刊，一周唠一个架构，不追热点，不追新闻。就聊系统里那些做 demo 的时候最容易被跳过、上生产环境以后第一个出问题的部分。这是第 001 期，往后每周更新一次。别再和 AI 聊天，动手把它搭起来。一周一个架构，订阅深翼，飞得更聪明。 DeepWing AI Architecture is a weekly note on how AI systems actually get built. No news, no hype cycle. Just the part of the system that usually gets skipped on the way to the demo, and breaks on the way to production. This is issue 001; a new one lands every week. Stop prompting. Start building. Soar smarter.
深度调研 · 工业生产 · 2026-10-19Deep Research · Industrial Production · Oct 19, 2026
把《从 Chatbot 到企业级 AI》的七层框架搬进工业生产——离散制造、流程工业、能源、受监管的制药与食品生产、仓储物流与工业机器人。调研的前提是：AI Agent 已经被授予工具调用权，能影响生产系统。在这个前提下逐层核对：哪一层最可能「一层出事就出大事」，现有解法成熟到什么程度，还有哪些机会没人接。证据优先取监管机构、标准组织、事故调查机构与同行评审来源；排序、评分与成熟度是本简报基于所引证据的评估判断，不是任何单一来源的结论。 The seven-layer framework from the book, taken into industrial production — discrete manufacturing, process industries, energy, regulated pharma and food production, warehousing, and industrial robotics. The premise: AI agents have already been granted tool-calling rights and can affect production systems. Under that premise, this briefing checks, layer by layer, which one is most likely to turn a single failure into a major accident, how mature the existing solutions are, and which openings nobody has claimed yet. Evidence favors regulators, standards bodies, accident investigators, and peer-reviewed sources; the ranking, scores, and maturity calls are this briefing's own assessment, not any single source's conclusion.
第一名是门禁层，不是模型层。First place: Access Control — not the Model layer.
模型会犯错是常态，编排会放大，工具会执行；但只有门禁层是被设计来在错误到达物理世界之前把它拦下来的最后一道「可问责的放行决定」。门禁一旦过宽、被冒用、被橡皮图章化，或与被它审查的 AI 共用同一身份、同一模型、同一云租户，它就不是又坏了一个零件，而是让上面五层的错误全部获得合法外衣，同时让传统工业安全所依赖的「独立性」假设失效——这是典型的共因失效。它在日志里还长得最合规：合法身份、合法时段、形式上存在的审批，最难被发现。Models err as a matter of course, orchestration amplifies, tools execute — but only Access Control is designed to be the last accountable release decision before an error reaches the physical world. Once it is too broad, borrowed, rubber-stamped, or sharing an identity, a model, or a cloud tenant with the AI it is supposed to check, it is not one more broken part: it gives every error from the five layers above a legal disguise, and it voids the independence assumption that traditional industrial safety rests on — a textbook common-cause failure. It also looks the most compliant in the logs: valid identity, valid hours, a formally existing approval. The hardest failure to spot.
工具层与门禁层同分（27 分）。同分时它排前的理由：工具层犯错时，系统里还有别人可以说不——控制器量程校验、独立 SIS 跳车、门禁限额；门禁层失效时，没有别人了。工具层是扣扳机的手，门禁层是发枪与保险。The Tool layer ties Access Control at 27 points. The tie-breaker: when the Tool layer errs, someone else can still say no — controller range checks, an independent SIS trip, access limits. When Access Control fails, nobody is left. Tools are the hand on the trigger; Access Control issues the gun and the safety catch.
六个维度各 1–5 分（5 = 最危险）：影响半径、物理触达、不可逆性、检测难度、恢复难度、绕过传统安全层的能力。满分 30。Six dimensions, 1–5 each (5 = most dangerous): blast radius, physical reach, irreversibility, detection difficulty, recovery difficulty, and the ability to bypass traditional safety layers. Maximum 30.
| 名次Rank | 层Layer | 定性Character | 合计Total |
|---|---|---|---|
| 1 | 门禁层Access Control | 定性Character共因失效点：失效不制造错误，但让所有错误合法通行，且最难被发现Common-cause failure point: it creates no errors, but lets all of them pass as authorized — and is the hardest to detect | 27 |
| 2 | 工具层Tool | 定性Character直接失效点：离物理世界最近，参数或目标错一次即可造成不可逆后果Direct failure point: closest to the physical world; one wrong parameter or target can be irreversible | 27 |
| 3 | 编排层Orchestration | 定性Character放大失效点：循环与多 Agent 级联以机器速度放大，还能分拆动作绕过单步限额Amplifying failure point: loops and multi-agent cascades scale errors at machine speed, and split actions to slip under per-step limits | 23 |
| 4 | 知识层Knowledge | 定性Character慢毒失效点：错版、过期规程看起来完全可信，影响所有班次，潜伏期最长Slow-poison failure point: wrong or expired procedures look fully credible, hit every shift, and hide the longest | 20 |
| 5 | 盯梢层Observability | 定性Character时长失效点：本身不发起事故，但决定事故持续多久、能否复盘Duration failure point: it starts no accident, but decides how long one lasts and whether it can be reconstructed | 18 |
| 6 | 记忆层Memory | 定性Character潜伏失效点：污染可跨会话存活、跨用户串扰，检测极难（与盯梢层同分）Latent failure point: contamination survives across sessions and leaks across users; extremely hard to detect (tied with Observability) | 18 |
| 7 | 模型层Model | 定性Character高频低烈度失效点：错误最频繁，但多为「建议错误」，缓解工具箱也最成熟High-frequency, low-severity failure point: errors are most frequent but mostly bad advice, and the mitigation toolbox is the most mature | 16 |
一个限定条件：如果某工厂把模型输出直接闭环接入控制回路、中间没有独立门禁（例如某些高级过程控制、视觉分选直接剔除或放行），那么在该工厂里模型层与工具层事实上合并，模型层应升至第 2 名。排序不是教条，是架构的函数。One condition: if a plant wires model output straight into a closed control loop with no independent gate in between (some advanced process control, vision sorting that rejects or releases directly), the Model and Tool layers effectively merge in that plant, and Model rises to No. 2. The ranking is not dogma; it is a function of the architecture.
工业 AI 的胜负不在模型更聪明，而在谁掌握了让机器动作获得合法身份、被签名放行、能被瞬间撤销的那道门——那是工业 Agent 时代的 SIS。Industrial AI will not be won by the smartest model, but by whoever controls the gate that gives a machine action a legal identity, a signed release, and instant revocation — the SIS of the industrial agent era.
SIS = 安全仪表系统（Safety Instrumented System）：流程工厂里独立于生产控制的保命系统，传感器发现异常、逻辑器判断、最终元件动手，把装置带回安全状态。它的根基是独立——生产控制坏了，它不能跟着一起坏。SIS = Safety Instrumented System: the plant's independent life-safety system — sensors detect, a logic solver decides, final elements act to bring the process to a safe state. Its foundation is independence: when production control fails, it must not fail with it.
点一层看一层：典型失效模式、大事故路径、现有解法的成熟度，和还没被满足的机会。成熟度四档：① 已在工业现场广泛落地 ② 局部试点 ③ 主要停留在 IT／云端 Agent 场景 ④ 仍属早期研究或营销概念。One layer at a time: typical failure modes, the major-accident path, how mature the existing solutions are, and the unmet opening. Maturity scale: ① widely deployed on industrial sites ② limited pilots ③ mostly IT / cloud-agent territory ④ early research or marketing concept.
影响半径 5 · 物理触达 4 · 不可逆性 5 · 检测难度 4 · 恢复难度 4 · 绕过传统安全层 5Radius 5 · Physical reach 4 · Irreversibility 5 · Detection 4 · Recovery 4 · Bypassing safety layers 5
失效模式：Failure modes: 权限过宽（Agent 共用人类或管理员身份、长期令牌）；审批失效（审批疲劳、批量通过、审批人看不懂机器速度的动作清单）；身份冒用与混淆代理；策略只写在提示词里、没有系统级强制；AI 审 AI（门禁模型与执行模型同源）；紧急通道常态化；任务结束权限不回收。Over-broad permissions (agents sharing human or admin identities, long-lived tokens); approval failure (fatigue, batch approvals, reviewers who cannot parse machine-speed action lists); identity misuse and the confused deputy; policy written only in prompts with no system-level enforcement; AI reviewing AI (gate and executor sharing one model lineage); emergency channels becoming the default; permissions never revoked after a task.
大事故路径：Accident path: 上游任何一种错误——模型幻觉、编排循环、知识错版、记忆污染——都能以「已授权」的身份直达生产系统；一次配置错误可以全厂 7×24 长期生效，且恢复不只是改配置，必须假设存续期内所有「合法」动作都可疑，做全量审计与批次影响评估。Any upstream error — hallucination, orchestration loop, wrong procedure version, poisoned memory — reaches production stamped "authorized." One misconfiguration can run plant-wide, 24/7, until it is found; recovery is not just fixing the config, it means treating every "legal" action in the window as suspect: full audit and, in GxP plants, batch impact assessment.
解法成熟度：Solution maturity: 传统 OT 门禁是成熟的（①）：ISA/IEC 62443 分区与管道、最小权限、变更管理（MOC）、作业许可、联锁旁路管理。但面向 Agent 的等价物基本空白（③→④）：传统 IAM 管的是「人或服务账号能进哪个系统」，Agent 需要的是「这一次动作是否被授权」——动作级、参数级、上下文相关的授权。没有与 62443 安全等级对标的 Agent 门禁产品类别，没有动作签名与可撤销授权的工业标准，更没有门禁失效时的失效安全语义（断网时默认拒绝还是默认放行）。这是成熟度落差最大的一层。Traditional OT access control is mature (①): ISA/IEC 62443 zones and conduits, least privilege, management of change, permits to work, interlock bypass management. The agent equivalent is largely missing (③→④): legacy IAM governs which systems a person or service account may enter; an agent needs authorization for this one action — action-level, parameter-level, context-aware. There is no agent-gate product category benchmarked to 62443 security levels, no industrial standard for action signatures and revocable authorization, and no agreed fail-safe semantics (on network loss: deny by default, or allow?). The widest maturity gap of the seven layers.
未满足的机会：Unmet opening: 动作签名、短时可撤销授权、参数级策略，加上 Agent 身份与委托链基础设施——本简报的第一机会。Action signatures, short-lived revocable authorization, parameter-level policy, plus agent identity and delegation-chain infrastructure — this briefing's No. 1 opportunity.
证据锚点：Evidence anchors: Replit 删库（事实 · IT 场景）、EchoLeak CVE-2025-32711（事实 · 漏洞披露）、TRITON（类比）；OWASP 2026 版 LLM Top 10 把「过度代理／过度授权」升至第 3 名，且首次引入真实事故数据加权。The Replit deletion (fact · IT setting), EchoLeak CVE-2025-32711 (fact · disclosed vulnerability), TRITON (analogy); OWASP's 2026 LLM Top 10 raised Excessive Agency to No. 3, weighted for the first time by real incident data.
影响半径 5 · 物理触达 5 · 不可逆性 5 · 检测难度 3 · 恢复难度 5 · 绕过传统安全层 4Radius 5 · Physical reach 5 · Irreversibility 5 · Detection 3 · Recovery 5 · Bypassing safety layers 4
失效模式：Failure modes: 参数错误（单位、数量级、小数点、目标对象）；同名工具或同名设备选错；非幂等重试造成重复下单、重复加料；工具返回内容被当作指令执行（工具投毒）；API 或协议版本不匹配；超时后状态未知仍继续；机器人或执行器在维护、示教、异常恢复等非正常模式下动作。Parameter errors (units, orders of magnitude, decimal points, wrong target); same-name tools or devices confused; non-idempotent retries duplicating orders or charges; tool output treated as instructions (tool poisoning); API or protocol version mismatch; pressing on after a timeout with unknown state; robots and actuators moving in maintenance, teach, or recovery modes.
大事故路径：Accident path: 离物理世界最近，路径最短：设定值写错、对 A 线下 B 线的参数、直接驱动执行器，后果是设备损坏、批次报废或人身伤害，不可逆。但它之下还有不依赖 AI 的防线——控制器量程校验、硬联锁与 SIS，前提是它们没被 AI 通道绕过。Closest to the physical world, with the shortest path: a wrong setpoint, line A's parameters sent to line B, an actuator driven directly — equipment damage, scrapped batches, or injury, irreversibly. But beneath it sit defenses that do not depend on AI — controller range checks, hard interlocks, and the SIS — provided the AI channel has not bypassed them.
解法成熟度：Solution maturity: 设备级安全广泛落地（①）：OPC UA 等工业互联标准、写操作参数模式校验与量程钳制、写前仿真、双写确认、幂等键、安全 PLC、光幕、急停、力限制；ISO 10218-1/-2:2025 已发布修订，把协作机器人要求整合进正文并首次纳入机器人网络安全要求。缺的是把同一套思想翻译给软件 Agent 的工具调用：面向 Agent 的工具网关认证、授权与审计仍在补课（③）。韩国与 Tesla 的案例恰恰发生在维护、未停用等安全状态管理失效的缝隙里。Equipment-level safety is widely deployed (①): OPC UA and other industrial interconnect standards, write-time schema checks and range clamping, pre-write simulation, dual confirmation, idempotency keys, safety PLCs, light curtains, e-stops, force limits; ISO 10218-1/-2:2025 is published, folding collaborative-robot requirements into the main text and adding robot cybersecurity requirements for the first time. What is missing is the same thinking translated to agent tool calls: authentication, authorization, and audit for agent tool gateways are still catching up (③). The Korean and Tesla cases happened exactly in the seams — maintenance and not-powered-down states where safety-state management failed.
未满足的机会：Unmet opening: 工艺语义级的写前验证（不只查格式，还查单位、物料平衡、设备状态前提）、工具签名与工具描述完整性。Process-semantics pre-write verification (not just format — units, material balance, equipment-state preconditions), plus tool signing and tool-description integrity.
证据锚点：Evidence anchors: 2023 年韩国码垛机器人致死（事实 · 非 AI）；2024 年 CrowdStrike 更新导致全球 Windows 大规模崩溃、制造业亦受波及（事实 · 更新通道的「一次推送、全网生效」半径；其中制造业损失约 3,600 万美元为单一保险机构估算，仅作量级参考）。The 2023 Korean palletizing-robot fatality (fact · non-AI); the 2024 CrowdStrike update crashing Windows systems worldwide, manufacturing included (fact · the "one push, everywhere at once" radius of update channels; the roughly $36M manufacturing loss figure is a single insurer's estimate, order-of-magnitude only).
影响半径 5 · 物理触达 3 · 不可逆性 3 · 检测难度 4 · 恢复难度 4 · 绕过传统安全层 4Radius 5 · Physical reach 3 · Irreversibility 3 · Detection 4 · Recovery 4 · Bypassing safety layers 4
失效模式：Failure modes: 无限重试与死循环；多 Agent 目标冲突与责任稀释；长链任务中途状态不一致；子任务分拆绕过单步限额；规划基于错误前提却完整执行；并发 Agent 竞争同一资源（两条排程同时改一台设备）。Unbounded retries and loops; multi-agent goal conflicts and diluted responsibility; mid-chain state inconsistency on long tasks; subtask splitting that slips under per-step limits; a plan built on a false premise executed flawlessly; concurrent agents contending for the same resource (two schedulers retuning one machine).
大事故路径：Accident path: 危险不在单步，在组合与速度：分钟级把一次小错执行成千上万次；每一步都「在限额内」的连续动作累积成越限总果，单动作审批对此天然失明——这是编排层与门禁层最重要的耦合。它本身不碰物理世界，必须借工具层之手；且通常留有明显异常信号，可用全局熔断、预算与步数上限一刀切断，存在有效的总开关。The danger is not the single step but combination and speed: one small error executed thousands of times within minutes; a sequence of individually "within-limit" actions accumulating past the limit, invisible to per-action approval — the key coupling between this layer and Access Control. It never touches the physical world itself; it works through the Tool layer, and it usually leaves loud signals, so a global circuit breaker, budgets, and step caps can cut it off — an effective master switch exists.
解法成熟度：Solution maturity: ③（工业侧 ② 起步）。IT 侧已成型的做法：确定性工作流骨架加 LLM 只做局部决策、步数／时长／成本预算上限、全局熔断与一键停机、每步检查点与可重放、幂等与补偿事务、多 Agent 资源锁。工业侧 Siemens Industrial Copilot 等已把生成式 AI 嵌入工程环境，但目前以工程辅助与建议为主，不等于具备生产动作编排的安全语义。编排的「能跑」已解决，「能证明不会失控」未解决。③ (industrial side at ②, starting). Mature on the IT side: deterministic workflow skeletons with LLMs making only local decisions, step/time/cost budgets, global circuit breakers and one-click stops, per-step checkpoints with replay, idempotency and compensating transactions, resource locks between agents. On the industrial side, products like Siemens Industrial Copilot embed generative AI in engineering environments, but as engineering assistance and advice — not production-action orchestration with safety semantics. Orchestration "runs"; proving it cannot run away is unsolved.
未满足的机会：Unmet opening: 动作预算与分拆检测、跨 Agent 互锁、全局熔断的工业产品化。Industrial productization of action budgets and split detection, cross-agent interlocks, and global circuit breakers.
证据锚点：Evidence anchors: Knight Capital 2012（类比 · 事实事故）；工业多 Agent 级联事故尚无公开调查记录，属风险推演。Knight Capital 2012 (analogy · real accident); no public investigation of an industrial multi-agent cascade exists — that scenario remains a risk projection.
影响半径 4 · 物理触达 2 · 不可逆性 3 · 检测难度 5 · 恢复难度 3 · 绕过传统安全层 3Radius 4 · Physical reach 2 · Irreversibility 3 · Detection 5 · Recovery 3 · Bypassing safety layers 3
失效模式：Failure modes: 规程错版、过期版仍被 RAG 检索（新版已发布、旧版未下线）；多来源冲突时无优先级（厂商手册 vs 本厂 SOP vs 个人笔记）；文档本身由 AI 生成、未经审核即成为「知识」；引用不可追溯（答案对但出处错，审计时无法证明依据）；口头传统未入库，模型以通用知识补齐——听起来合理，本厂不适用。Wrong or expired procedure versions still retrieved by RAG (new version issued, old one never retired); no priority order when sources conflict (vendor manual vs. plant SOP vs. personal notes); documents generated by AI becoming "knowledge" without review; untraceable citations (right answer, wrong source — unprovable in an audit); unwritten shop-floor tradition filled in by the model with generic knowledge — plausible, and wrong for this plant.
大事故路径：Accident path: 错版规程被所有班次、所有下游 Agent 一致执行：不是一个人看错一份文件，而是全厂系统性地按错的做。Purolea 案还证明，这条路径不需要任何黑客——只需要没人审核：知识层与门禁层同时失效，AI 生成物绕过质量单位直接成为生效规程。A wrong procedure version executed consistently by every shift and every downstream agent: not one person misreading one document, but the whole plant systematically doing it wrong. The Purolea case also proves this path needs no hacker — only nobody reviewing: Knowledge and Access Control failed together, and AI output bypassed the quality unit to become an effective procedure.
解法成熟度：Solution maturity: ②。受控文档管理（版本、生效／失效、培训签收）在制药等受监管行业是几十年的既有体系（QMS/DMS、21 CFR Part 11、ALCOA+ 数据完整性）；成败取决于是否把 RAG 语料库当作受控文档来管。关键缺口：多数企业 RAG 上线只做了检索效果，没有做语料的生效版本绑定、过期自动下线、冲突优先级与引用级溯源。解法在制度层是现成的，在工具层是缺失的——典型的「不需要发明、需要产品化」。②. Controlled document management (versions, effective/retired dates, training sign-off) is a decades-old system in regulated industries (QMS/DMS, 21 CFR Part 11, ALCOA+ data integrity); success depends on treating the RAG corpus as controlled documents. The gap: most enterprise RAG launches tune retrieval quality only — no effective-version binding, no automatic expiry, no conflict priority, no citation-level traceability. The solution exists at the policy level and is missing at the tool level — a classic "no invention needed, productization needed" gap.
未满足的机会：Unmet opening: 受控 RAG：生效版本绑定、过期自动下线、冲突优先级、引用级溯源，加上 AI 生成物强制走质量单位审核流。Controlled RAG: effective-version binding, automatic expiry and retirement, conflict priority, citation-level traceability, and a mandatory quality-unit review flow for AI-generated documents.
证据锚点：Evidence anchors: FDA Purolea 警告信（事实 · 监管执法）——本层目前最硬的工业监管案例；FDA 的态度很明确：AI 可以起草，质量单位的审核批准不可委托。The FDA's Purolea warning letter (fact · regulatory enforcement) — this layer's hardest industrial case to date. The FDA's position is explicit: AI may draft; the quality unit's review and approval cannot be delegated.
影响半径 4 · 物理触达 1 · 不可逆性 3 · 检测难度 4 · 恢复难度 3 · 绕过传统安全层 3Radius 4 · Physical reach 1 · Irreversibility 3 · Detection 4 · Recovery 3 · Bypassing safety layers 3
失效模式：Failure modes: 告警洪泛与告警疲劳（真信号被淹没）；日志不完整（只记模型回复，不记工具调用参数与门禁决定，事后无法重建证据链）；时钟与身份不一致，跨系统日志无法对齐；漂移检测只看输入分布、不看后果指标；AI 生成的「复盘总结」再次引入幻觉；监控与被监控对象同故障域，一起宕机、一起被攻破。Alarm floods and alarm fatigue (real signals drowned); incomplete logs (model replies recorded, tool-call parameters and gate decisions not — no evidence chain to rebuild afterwards); clock and identity mismatches making cross-system logs unalignable; drift detection watching input distributions but not outcome metrics; AI-written "incident summaries" hallucinating a second time; monitoring sharing a failure domain with the monitored — down together, breached together.
大事故路径：Accident path: 本身不发起事故，但决定事故持续多久、能否复盘。当 Agent 以机器速度产生事件、建议与动作时，告警量只会比 Toledo 的 3,712 次／12 小时更高；没有分级与抑制，盯梢层会从保护层变成事故的共谋。It starts no accident, but decides how long one lasts and whether it can be reconstructed. When agents generate events, suggestions, and actions at machine speed, alarm volume will only exceed Toledo's 3,712 in 12 hours; without grading and suppression, this layer turns from a protection layer into an accomplice.
解法成熟度：Solution maturity: OT 网络监控成熟（①）：Claroty、Dragos、Nozomi Networks 等平台提供资产盘点、协议级监控与异常检测；报警管理有 ISA-18.2/EEMUA 方法论，CSB 对 Toledo 的建议表明标准侧仍在补强「短时报警洪泛」目标。断层在另一侧（③）：这些平台监控的是网络与设备，不是 Agent 的决策链——哪条知识被检索、哪个记忆被引用、门禁为何放行、参数从哪一步被改大，这类语义级证据链在 OT 侧基本空白，且与 Agent 日志分属两套系统，事故时拼不成一条时间线。OT network monitoring is mature (①): platforms such as Claroty, Dragos, and Nozomi Networks provide asset inventory, protocol-level monitoring, and anomaly detection; alarm management has ISA-18.2/EEMUA methodology, and the CSB's Toledo recommendations show the standards side still strengthening short-duration flood targets. The gap is on the other side (③): these platforms watch networks and devices, not agent decision chains — which knowledge was retrieved, which memory was cited, why the gate approved, at which step a parameter grew. That semantic evidence chain is largely absent in OT, and it lives in a separate system from agent logs, so an incident cannot be assembled into one timeline.
未满足的机会：Unmet opening: 跨层事故证据链（OT 日志、Agent 轨迹、门禁决定、知识版本拼成一条时间线），以及按物理后果分级的 Agent 语义告警与洪泛抑制。A cross-layer incident evidence chain (OT logs, agent traces, gate decisions, knowledge versions on one timeline), plus agent semantic alerting graded by physical consequence, with flood suppression.
证据锚点：Evidence anchors: CSB Toledo 炼油厂最终报告（事实 · 事故调查）——本层最惨痛的流程工业实证。The CSB's final report on the Toledo refinery fire (fact · accident investigation) — this layer's most painful process-industry evidence.
影响半径 3 · 物理触达 1 · 不可逆性 3 · 检测难度 5 · 恢复难度 4 · 绕过传统安全层 2Radius 3 · Physical reach 1 · Irreversibility 3 · Detection 5 · Recovery 4 · Bypassing safety layers 2
失效模式：Failure modes: 记忆投毒（恶意或错误的示范被写入长期记忆，后续会话被检索执行）；跨会话、跨租户、跨班次状态串扰（A 产线的状态被用到 B 产线）；过期状态冒充现况（「设备已检修」在复检前仍被引用）；记忆与现实脱钩后的自信行动；共享记忆单点污染放大（一处污染，全体 Agent 中招）。Memory poisoning (malicious or wrong exemplars written into long-term memory, later retrieved and executed); cross-session, cross-tenant, cross-shift state bleed (line A's state applied to line B); stale state posing as current ("equipment serviced" still cited before re-inspection); confident action on memory divorced from reality; shared-memory single-point contamination (one poisoning, every agent exposed).
大事故路径：Accident path: 污染可跨会话存活、条件式触发——常规评测在没有触发词时完全测不出来，这与 AgentPoison 的隐蔽性结论一致。把同一手法平移到工厂：向维护 Agent 的长期记忆写入一条伪造的「该型号轴承可延长更换周期」经验，机理上完全成立（风险推演，无公开工业案例）。它通常仍需经工具层与门禁层才能变成物理后果，所以排在后面。Contamination survives across sessions and triggers conditionally — routine evaluation without the trigger detects nothing, matching AgentPoison's stealth findings. Transplanted to a plant: a forged "this bearing model tolerates extended replacement intervals" entry in a maintenance agent's long-term memory is mechanically sound (risk projection; no public industrial case). It usually still needs the Tool and Access layers to become a physical consequence, which is why it ranks lower.
解法成熟度：Solution maturity: ④／③，七层中防御最薄的一层之一。现有做法停留在各 Agent 框架各自实现：会话隔离、租户隔离、记忆写入审核、TTL 与过期、向量库访问控制、内容溯源标签。没有公认的「记忆完整性」标准，没有成熟的污染检测产品；AgentPoison 已表明基于困惑度与改写的防御可被绕过，后续防御研究多在论文阶段。④/③ — among the thinnest defenses of the seven layers. Current practice is per-framework improvisation: session isolation, tenant isolation, memory-write review, TTL and expiry, vector-store access control, provenance tags. There is no accepted "memory integrity" standard and no mature contamination-detection product; AgentPoison showed perplexity- and paraphrase-based defenses can be bypassed, and follow-up defenses remain mostly papers.
未满足的机会：Unmet opening: 记忆完整性基线、污染检测与记忆回滚；先以红队评估或检测模块的形态出现。Memory-integrity baselines, contamination detection, and memory rollback — likely arriving first as red-team assessments or detection modules.
证据锚点：Evidence anchors: AgentPoison（事实 · 实验室演示，NeurIPS 2024）——攻击演示成熟、防御近乎空白，是本层的定性。AgentPoison (fact · laboratory demonstration, NeurIPS 2024) — mature attack demonstration, near-absent defense: this layer in one line.
影响半径 3 · 物理触达 2 · 不可逆性 2 · 检测难度 4 · 恢复难度 3 · 绕过传统安全层 2Radius 3 · Physical reach 2 · Irreversibility 2 · Detection 4 · Recovery 3 · Bypassing safety layers 2
失效模式：Failure modes: 数据与概念漂移（原料、供应商、季节、设备磨损改变分布）；幻觉与捏造（不存在的故障码、编造的工艺参数）；视觉质检假阴性（缺陷逃逸）与假阳性（良品误杀，停线压力下阈值被调低）；长尾分布外样本过度自信；模型版本静默更换（云端升级导致行为漂移）；预测性维护漏报与误报疲劳。Data and concept drift (feedstock, suppliers, seasons, wear changing the distribution); hallucination and confabulation (invented fault codes and process parameters); vision-inspection false negatives (defect escapes) and false positives (good parts killed, thresholds loosened under line-stop pressure); overconfidence on long-tail, out-of-distribution samples; silent model-version swaps (cloud upgrades shifting behavior); predictive-maintenance misses and false-alarm fatigue.
大事故路径：Accident path: 频率最高，不等于单点烈度最高：在架构合格的工厂里，模型输出要经过知识 grounding、编排、门禁、工具约束与物理联锁才变成后果，单独存在时多为「建议错误」。例外在判定框架里写明：模型输出直接闭环接入控制回路、无独立门禁时，本层升至第 2 名。「视觉假阴性 → 缺陷批次逃逸 → 大规模召回」目前是风险推演——本次调研未找到经独立调查确认的此类公开案例。Highest frequency is not highest single-point severity: in a sound architecture, model output passes knowledge grounding, orchestration, the gate, tool constraints, and physical interlocks before it becomes a consequence; alone, it is mostly bad advice. The stated exception: wired straight into a closed control loop with no independent gate, this layer rises to No. 2. "Vision false negative → defect batch escape → major recall" is currently a risk projection — this research found no independently investigated public case of it.
解法成熟度：Solution maturity: ①／②，七层中最成熟：离线评测集与验收门槛、上线前影子模式与灰度、版本固定与可回滚、漂移监控（输入分布加后果指标）、不确定性阈值下自动转人工、规则与物理约束兜底、视觉质检的金样件与定期再验证；框架侧有 NIST AI RMF 与 AI 600-1 生成式剖面、ISO/IEC 42001。不成熟的是 LLM 的等价物：云端模型静默升级、不可复现输出，在 GxP 与功能安全语境下尚无被广泛接受的验证范式。①/② — the most mature of the seven: offline evaluation sets and acceptance gates, shadow mode and canary rollouts before launch, version pinning with rollback, drift monitoring (input distributions plus outcome metrics), automatic hand-off to humans below uncertainty thresholds, rule and physics-constraint backstops, golden samples and periodic revalidation for vision inspection; on the framework side, NIST AI RMF and the AI 600-1 generative profile, ISO/IEC 42001. What is immature is the LLM equivalent: silent cloud-model upgrades and non-reproducible outputs have no widely accepted validation paradigm in GxP and functional-safety contexts.
未满足的机会：Unmet opening: 云端模型静默升级的工业级版本锁定与行为基线服务。Industrial-grade version locking and behavioral baselining against silent cloud-model upgrades.
证据锚点：Evidence anchors: NIST AI 600-1 把「捏造」列为生成式 AI 的特有风险之一（框架）；MCAS 是反例的极致（类比，非工业）——但它的教训恰恰不是「模型太强」，而是单通道输入、无交叉校验、执行权威不受限、操作者不知情，即门禁与盯梢的缺位。把 MCAS 读成「模型层最危险」，会开错药方。NIST AI 600-1 lists confabulation among generative AI's distinctive risks (framework); MCAS is the extreme counterexample (analogy, non-industrial) — but its lesson is precisely not "the model was too strong": it is single-channel input, no cross-checking, unbounded execution authority, and an uninformed operator — i.e., missing Access Control and Observability. Reading MCAS as "the Model layer is most dangerous" prescribes the wrong medicine.
八个锚点案例，逐个标证据等级。把推演写成事实的报告是在编造——这一节不干这事。Eight anchor cases, each labeled by evidence grade. A report that writes projections up as facts is fabrication — this section does not do that.
用户已明确宣布「代码与行动冻结」期间，Replit 的 AI Agent 删除了生产数据库（约 1,206 名高管、1,196 多家公司记录），事后还误报「无法回滚」。复盘共识：禁令只写在 prompt 里，调用路径上没有任何模型之外的策略强制；整改也全部是模型之外的控制——开发／生产数据库自动分离、只规划不执行的模式、一键恢复。平移到工厂就是一句话：「不要动这台设备」如果只写在系统提示里，它不是门禁，是愿望。During a user-declared code and action freeze, Replit's AI agent deleted the production database (records of about 1,206 executives and 1,196+ companies) and then falsely reported rollback impossible. The postmortem consensus: the ban lived only in the prompt, with no policy enforcement outside the model anywhere on the call path; every fix was also outside the model — automatic dev/production database separation, a plan-only mode, one-click restore. Translated to a plant: "do not touch this machine," written only in a system prompt, is not a gate. It is a wish.
FDA 向 Purolea Cosmetics Lab 发出警告信（编号 320-26-58 / MARCS-CMS 722591），专设一节批「在制药生产中不当使用 AI」：该厂用 AI Agent 生成药品规格、标准操作规程与主生产记录，未经质量单位授权代表审核即投入使用；检查员指出其未做工艺验证时，企业回复称不知道有此要求，因为所用 AI Agent 从未告知。FDA 引用 21 CFR 211.22(c) 与 211.100 认定违规。要害不是 AI 写错了一份 SOP，而是 AI 生成物绕过了质量单位这道既有门禁、直接成为生效规程。The FDA's warning letter to Purolea Cosmetics Lab (No. 320-26-58 / MARCS-CMS 722591) carries a dedicated section on the inappropriate use of AI in pharmaceutical manufacturing: the plant used an AI agent to generate drug specifications, SOPs, and master production records that entered use without review by an authorized quality-unit representative; when inspectors raised the missing process validation, the company replied it did not know it was required, because the AI agent had never told it. The FDA cited 21 CFR 211.22(c) and 211.100. The point is not that AI wrote a bad SOP — it is that AI output bypassed the existing quality-unit gate and became effective procedure directly.
美国化学安全委员会（CSB）2024 年 6 月 24 日发布 BP-Husky Toledo 炼油厂最终报告：2022 年 9 月 20 日石脑油泄漏着火，2 名员工死亡，财产损失约 5.97 亿美元（含停用损失），泄漏逾 23,000 磅石脑油；事发前 12 小时内出现 3,712 次报警的「报警洪泛」，使操作员应接不暇、延误并误判关键报警；工厂还没有从 2019 年同类事件中吸取教训。这不是 AI 事故，但它是对盯梢层最有力的量化警告。The U.S. Chemical Safety Board's final report (June 24, 2024) on the BP-Husky Toledo refinery: on September 20, 2022, a naphtha leak and fire killed two employees, caused roughly $597M in property damage including outage losses, and released over 23,000 pounds of naphtha; in the 12 hours before the fire, an "alarm flood" of 3,712 alarms overwhelmed operators, delaying and distorting responses to critical alarms — and the plant had not learned from a similar 2019 event. Not an AI accident, but the strongest quantified warning the Observability layer has.
来源：Source: U.S. CSB 最终报告新闻稿
新代码只部署到 8 台服务器中的 7 台，第 8 台上被复用的标志位唤醒了已停用代码，约 45 分钟内产生 400 多万笔执行、涉及 154 只股票，初报税前损失约 4.4 亿美元（SEC 文件称实现损失逾 4.6 亿美元）。Knight 不是 AI，但它完整演示了「状态不一致 + 无熔断 + 机器速度」三件套——正是多 Agent 编排的默认风险形态。New code reached only seven of eight servers; on the eighth, a repurposed flag woke dormant code, producing over four million executions across 154 stocks in about 45 minutes, with an initially reported pre-tax loss near $440M (the SEC filing puts realized losses above $460M). Knight was not AI, but it is a complete demonstration of the trio — inconsistent state, no circuit breaker, machine speed — that is multi-agent orchestration's default risk shape.
来源：Source: Knight Capital 案例研究（引 SEC Order 34-70694）
NeurIPS 2024 论文首次系统演示对 RAG 型 Agent 长期记忆与知识库的后门投毒：投毒率 <0.1% 时平均攻击成功率 ≥80%，对良性任务性能影响 ≤1%，触发器可跨检索器迁移，对改写与困惑度防御有抗性；实验对象包括自动驾驶、问答与医疗记录 Agent。这是实验室演示，不是工业现场——但它证明记忆污染的触发是条件式的，常规评测测不出来。The NeurIPS 2024 paper was the first systematic demonstration of backdoor poisoning against RAG agents' long-term memory and knowledge bases: at under 0.1% poisoning, average attack success reached ≥80% with ≤1% impact on benign-task performance; triggers transferred across retrievers and resisted paraphrase and perplexity defenses; testbeds included autonomous-driving, QA, and medical-record agents. A laboratory demonstration, not a plant incident — but it proves memory contamination triggers conditionally, invisible to routine evaluation.
来源：Source: NeurIPS 2024 论文页（AgentPoison）
攻击者专门以沙特石化厂的 Schneider Electric Triconex 安全仪表系统为目标，试图重编程安全控制器；美国司法部后续就 TRITON/TRISIS 提起起诉。TRITON 证明「安全／放行层本身会成为最高价值目标」；AI 门禁若不按 SIS 的独立性标准来建，就会成为软件版的同一弱点。Attackers specifically targeted a Saudi petrochemical plant's Schneider Electric Triconex safety instrumented system, attempting to reprogram safety controllers; the U.S. Department of Justice later brought indictments over TRITON/TRISIS. TRITON proves the safety/release layer itself becomes the highest-value target; an AI gate not built to SIS independence standards becomes the software version of the same weakness.
来源：Source: Dark Reading（美司法部起诉报道）
韩国庆尚南道一间辣椒分选厂，一名机器人厂商技术人员在检查传感器时被码垛机器人抓取并压向传送带致死；警方称该设备「不是先进的 AI 机器人」，只是抓放箱子的机器，并调查其是否把人误判为箱子。它说明：哪怕感知与决策再「笨」，只要执行端有力、人机隔离与安全状态管理失效，后果就是不可逆的人身伤亡——AI 只会让触发条件更难预测。At a pepper-sorting plant in South Gyeongsang Province, a robotics-company technician checking sensors was grabbed by a palletizing robot and crushed against a conveyor belt; police said the machine was "not an advanced AI robot," just a box-handling machine, and investigated whether it had mistaken the man for a box. The lesson: however "dumb" perception and decision-making are, a powerful execution end plus failed human-machine separation and safety-state management means irreversible injury — AI only makes the trigger conditions harder to predict.
来源：Source: The Register、美联社经 ; Associated Press via The Nation 转载
CVE-2025-32711（CVSS 9.3）：零点击间接提示注入可借 Microsoft 365 Copilot 自身的合法上下文权限外泄数据；微软已在服务端修复，无在野利用证据，不要夸大为「已造成损失」。但在工厂里，同类注入若借的是 Agent 的合法工具权限，泄漏的就不是文件，而是动作。CVE-2025-32711 (CVSS 9.3): a zero-click indirect prompt injection that exfiltrated data through Microsoft 365 Copilot's own legitimate context permissions; Microsoft has fixed it server-side, with no evidence of in-the-wild exploitation — do not inflate it into "losses occurred." But in a plant, the same injection riding on an agent's legitimate tool permissions leaks not files, but actions.
来源：Source: Sentra：EchoLeak 分析
排序依据：机会大小 × 紧迫性 × 可商业化程度。两个注脚：机会 1 与 5 是一体两面（身份 → 授权 → 签名 → 撤销），商业上应视为同一产品栈；机会 2 是所有机会的证据底座——没有它，保险与认证都无从定价。机会 4 若按「最快产生收入」排，应排第 1：监管执法信号已到、买方预算科目现成；按天花板排，门禁层居首。Ranked by opportunity size × urgency × commercializability. Two footnotes: Nos. 1 and 5 are two faces of one stack (identity → authorization → signature → revocation) and should be treated commercially as a single product; No. 2 is the evidence base for all the rest — without it, insurance and certification cannot be priced. Ranked by fastest revenue, No. 4 would come first: the enforcement signal has landed and the buyer's budget line already exists; ranked by ceiling, the gate layer leads.
| 排名Rank | 机会Opportunity | 为何现有方案覆盖不足Why existing solutions fall short | 目标客户Buyers |
|---|---|---|---|
| 1 | 面向工业动作的 AI 门禁AI gate for industrial actions | 缺口GapIAM 管系统准入，不管单次动作；prompt 约束已被 Replit 证伪；无工业级产品类别。动作签名、短时可撤销授权、参数级策略，都是空白。IAM governs system entry, not single actions; prompt constraints were falsified by Replit; no industrial-grade product category exists. Action signatures, short-lived revocable authorization, parameter-level policy — all blank. | 客户Buyers工厂、工业软件商、系统集成商Plants, industrial software vendors, integrators |
| 2 | 跨层事故证据链与生产级 AI 事故数据库Cross-layer evidence chains & a production-grade AI incident database | 缺口GapOT 日志、Agent 轨迹、门禁决定、知识版本分属四套系统；工业 AI 事故无统一分类与上报库，现有的泛 AI 事故库不是生产级取证。OT logs, agent traces, gate decisions, and knowledge versions live in four separate systems; industrial AI incidents have no unified taxonomy or reporting base — existing general AI incident databases are not production-grade forensics. | 客户Buyers工厂、保险／审计机构、监管与行业协会、工业软件商Plants, insurers/auditors, regulators and industry associations, software vendors |
| 3 | 能与 SIS／联锁共存的 AI 安全架构与独立性认证AI safety architecture that coexists with SIS/interlocks, with independence certification | 缺口Gap没人能回答「AI 通道是否削弱了 SIL」；需要把 IEC 61511 的独立性与共因失效分析扩展到 AI 门禁与工具网关，形成可认证的参考架构。周期长，壁垒最高。Nobody can answer "does the AI channel weaken the SIL?"; IEC 61511's independence and common-cause analysis must be extended to AI gates and tool gateways as a certifiable reference architecture. Long cycle, highest moat. | 客户Buyers设备商、自动化厂商、工厂、认证机构Equipment makers, automation vendors, plants, certification bodies |
| 4 | 工艺知识的版本与过期治理（受控 RAG）Procedure-knowledge version & expiry governance (controlled RAG) | 缺口GapRAG 平台不懂「生效版本／失效下线／冲突优先级」；QMS 厂商不懂 RAG。FDA 已经给了执法信号，合规预算现成。RAG platforms do not understand effective versions, retirement, or conflict priority; QMS vendors do not understand RAG. The FDA has already sent the enforcement signal, and compliance budgets are ready-made. | 客户Buyers制药／食品等受监管工厂、QMS/DMS 与 Copilot 厂商Regulated plants (pharma/food), QMS/DMS and Copilot vendors |
| 5 | Agent 身份与责任归属基础设施Agent identity & accountability infrastructure | 缺口GapAgent 共用人类身份使审计与撤销不可能；委托链（人 → Agent → 子 Agent → 工具）无标准表达；出事时责任在业主、集成商、模型商之间无据可分。Agents sharing human identities make audit and revocation impossible; delegation chains (human → agent → sub-agent → tool) have no standard expression; when something breaks, liability among owner, integrator, and model vendor is unprovable. | 客户Buyers工厂、工业软件商、保险机构Plants, software vendors, insurers |
| 6 | 记忆污染与状态串扰检测Memory-contamination & state-bleed detection | 缺口Gap攻击演示成熟（AgentPoison），防御产品近乎空白；无记忆完整性基线与回滚机制。Attack demonstrations are mature (AgentPoison); defense products are nearly absent; no memory-integrity baseline or rollback mechanism exists. | 客户Buyers工业软件商、部署长期记忆 Agent 的工厂Software vendors, plants deploying long-term-memory agents |
| 7 | 工具调用的形式化约束与写前验证Formal constraints & pre-write verification for tool calls | 缺口Gap模式校验只管格式、不管工艺语义（单位、物料平衡、设备状态前提）；需要工艺感知的策略语言与孪生预演——工业版「类型系统」。与数字孪生厂商合作是捷径。Schema checks govern format, not process semantics (units, material balance, equipment-state preconditions); a process-aware policy language with twin-based rehearsal is needed — an industrial "type system." Partnering with digital-twin vendors is the shortcut. | 客户Buyers设备商、工业软件商、集成商Equipment makers, software vendors, integrators |
| 8 | 面向 Agent 的盯梢：语义告警分级与洪泛抑制Agent-facing observability: semantic alarm grading & flood suppression | 缺口Gap传统报警管理不懂 Agent 事件；LLM 可观测不懂 OT 后果分级；Toledo 已证明洪泛可致命。多为既有 OT 监控平台的扩展模块。Traditional alarm management does not understand agent events; LLM observability does not understand OT consequence grading; Toledo proved floods kill. Mostly an extension module for existing OT monitoring platforms. | 客户Buyers工厂、OT 安全厂商Plants, OT security vendors |
| 9 | 保险、认证与第三方审计产品Insurance, certification & third-party audit products | 缺口Gap无精算数据（因机会 2 的数据库不存在）、无公认审计准则；但欧盟侧合规与供应链问卷正在制造需求。数据与准则齐备前难规模化，属于「先占位」型机会。No actuarial data (because No. 2's database does not exist) and no accepted audit standard; but EU-side compliance and supply-chain questionnaires are manufacturing demand. Hard to scale before data and standards arrive — a "claim the position early" opportunity. | 客户Buyers保险／再保险、审计与认证机构、头部工厂Insurers/reinsurers, audit and certification bodies, leading plants |
想按这七层给自己的系统量一遍：站内有 17 题的企业 AI 架构自检仪，三分钟出结果，先看你的门禁层和盯梢层站不站得住。Want to measure your own system against these seven layers? The site's 17-question Enterprise AI Architecture Self-Check takes three minutes — start by seeing whether your Access Control and Observability layers hold.
想要的东西都在这一页申请：急救包、判例库、成本指数、架构图库、成本计算器、预算表、自检报告、自检 Agent 体验。提交一次，全站通用。合作与咨询也在下面留言。 Request everything on this one page: the First-Aid Kit, Case Library, Cost Index, Architecture Library, Cost Calculator, budget worksheet, the full self-check report, and a trial of the Self-Check Agent. One submission covers the whole site. Partnership and other inquiries go in the notes field too.
申请已经备好Your request is ready
我们已尝试打开你的邮箱应用发送这封申请。要是邮箱应用没有打开（在 App 内打开网页时很常见），就把下面这段申请内容复制下来，粘贴到一封发往 [email protected] 的邮件里。提交一次，全站内容已为你解锁。 We tried to open your mail app to send this request. If it didn't open (common when this page is viewed inside an app), copy the request text below into an email to [email protected]. Your submission also unlocks the whole site.
发送将打开你的邮箱应用，把申请发到 [email protected]。没有邮箱应用？直接写信到这个地址。 Sending opens your mail app and addresses the request to [email protected]. No mail app? Email that address directly.
