No data enters the system unseen by a human: the gate is at the transfer

The problem

The most expensive errors in the plant are born at the transfer.

The transfer is where the plant's most expensive errors concentrate: pumping from the wrong tank, packaging a product with the previous label, assigning the previous run's batch number. Any of the three produces a drum that goes out into the world saying something untrue. Today's barriers are the operator's judgment and a paper signature nobody retrieves. There is no automatic cross-check between what the order says and what is physically on the line. And there is a practical constraint that kills most controls people try: any verification that costs the operator a minute per container is abandoned within two weeks. It has to cost seconds or it will not be used.

• Pumping from the wrong tank. Packaging a product under the previous run's label. Assigning the batch number of the blend before. Any of the three produces a drum that goes out into the world saying something untrue, with a GHS hazard label to match.
• Today's barriers are the operator's judgment and a paper signature nobody retrieves. There is no automatic cross-check between what the blending order says and what is physically hooked up on the line.
• Every control the plant has tried so far cost the operator a minute per container, and every one was abandoned within two weeks. It has to cost seconds or it will not be used.
• When a customer returns a mis-identified container, the conversation is not about that drum: it is about every drum from that shift, and about the credentials that let you sell to them.

How it fits the IRIS system

Connect with early human verification — two taps at the transfer line.

Connect in "early human verification" mode.

The system does not ask the operator to fill in a form. It shows the cross-check already done — product, source tank, batch, pack size, the hazard label that applies — and asks for two taps or a correction. It is the piece that guarantees nothing enters master data without a human gesture, and it is what makes the other eleven approvable. Two taps is the price; a drum that says the truth is what it buys.

• Industrial tablet mounted at the transfer line.
• iLEAN presents the cross-check already done — product, source tank, batch, destination pack size and the hazard label that applies — not a blank form.
• The operator confirms with two taps, or corrects the failing field with one.
• Only then does the data cross into the central system, signed with who and when.
• That signature later feeds the auditable evidence pack (case 11).

This is what separates an IRIS system from an autonomous agent: the AI proposes and captures, the human validates, and nothing enters master data without that gesture.

See the full IRIS architecture →

Before and after

Today's transfer versus the validated transfer

Aspect	Today	With iLEAN
Cross-check order vs. line	The operator's memory	Presented on the tablet, already done
Cost per container	A signature nobody retrieves	Two taps
Wrong source tank	Found at the customer	Blocked before the valve opens
Hazard label	Whatever was printed	Checked against the product's SDS
Who enters the data	Whoever types it later	Whoever stood at the line, by name
Evidence for an audit	A filing cabinet	Searchable by transfer

from data entering unreviewed to zero data without a human signature · from an unrecoverable paper signature to traceability searchable by transfer · from controls that would cost minutes to a control that costs seconds.

Impact estimate

Impact estimate — to be validated with your numbers.

The block below is an estimate to be validated against your plant's actual data. We put it forward so the committee has an order of magnitude; we refine it during the assessment.

• Estimated payback 4-9 months, heavily dependent on what a single mis-identified container returned by a customer cost you last time.
• The dominant value here is not productivity, it is risk: the product identity error is blocked at the point where it is born, not discovered at a branch.
• An audit evidence base at no extra effort: every transfer carries who confirmed it, when, and what they corrected.
• And a control that costs seconds is a control that is still in use in month six, unlike the ones that cost a minute per container.

reduced risk of product identity error at the point where it is born, plus an audit evidence base at no extra effort. Estimated payback of 4 to 9 months, heavily dependent on the cost of a single mis-identified container returned by a customer. *Estimate to validate.*

And the fair question from the production manager

“If a person confirms in the end, what is the AI saving?” — the work is not in deciding, it is in assembling. Today nobody cross-checks order, tank, container and label with a drum waiting under the nozzle. Assembling that summary from the order, the tank map and the product's SDS is an anchored task, where the best models drop below 1.5% error [1], and the operator only confirms or corrects. Every correction is stored with its author: the system learns where its extraction fails, and the plant keeps a trail.

^[1] OpenAI paper "Why Language Models Hallucinate", 2025 — on the reliability of AI in anchored tasks.