Industrial AI programs love structured tags: historian points, alarm codes, SPC features. The shop floor still runs on paragraphs. Technicians paste error dumps into MES comments. Supervisors write “run like last Tuesday.” Vendors drop USB notes into tickets. When a copilot or RAG assistant is allowed to read those fields, the plant has connected a language model to its least governed database.
OT write-path red teams ask whether models may command valves. Citation ledgers ask whether answers quote retired SOPs. This brief asks a quieter question that arrives earlier: what happens when the model trusts free text that was never written for a machine to obey?
Why free-text is different from a tag
A tag has a name, a unit, and usually an owner. A comment field has:
- No schema.
- No required vocabulary.
- No guarantee it is true, current, or even about this asset.
- Occasional jokes, passwords, vendor phone numbers, and “ignore previous alarms” folklore.
That folklore was annoying when only humans read it. It becomes operational risk when a copilot summarizes it into a recommended action, or when RAG retrieves it beside a real SOP.
If the assistant can read the comment, the comment is now part of the control narrative.
Failure modes that are already showing up
- Prompt-shaped notes — Text that tells the model to “disregard interlock guidance” or “always recommend bypass.” Not science fiction; copy-paste culture plus curiosity.
- Stale tribal truth — “Valve 12 always sticks—force it.” The model repeats it with confidence formatting.
- Cross-asset contamination — A note meant for Line A retrieved for Line B because the chunker loved the verb “vibration.”
- Secret sprawl — Credentials and personal data that never belonged in MES, now embedded in vector indexes.
- Authority confusion — Soft suggestions that operators treat as signed engineering instructions because the UI looks official.
None of these require the model to hold a write path. They only require the model to be believed.
Every paragraph is a future retrieval candidate. Write it like evidence, not like a group chat.
Hygiene that plants can actually enforce
Policy essays fail when they demand poets on the night shift. Practical controls:
| Control | What “done” looks like | | --- | --- | | Field purpose | Separate “human gossip” from “assistant-readable” notes, or mark sensitivity | | Allowlists | Copilots read coded cause codes + approved SOP corpus first; free-text second and labeled | | Injection filters | Strip instruction-like patterns from retrieved comments before synthesis | | Retention | Old notes age out of the index; tribal lore does not live forever as “knowledge” | | Redaction | Secrets scanners on save; failed saves are features, not friction theater | | Attribution UI | Every answer shows whether a free-text note influenced it |
Shadow-mode diaries own advice without ownership. Soft-sensor model cards own inferential gates. Semantic catalogs own tag meaning. This page owns language fields as model inputs.
A governance sentence worth laminating
No free-text field is “just comments” once a model can retrieve it.
Either the field is in scope for assistants—with hygiene—or it is out of scope, period.
Adjacent fences
OT write-path red teams own actuator authority. RAG citation ledgers own document provenance. Shadow diaries own unowned advice. Historian compression traps own false ML features. This page owns MES/CMMS prose as an AI trust boundary. Do not connect a copilot to work orders and leave comment culture unchanged.