The human signature is not automated. It is supported

The problem

Any automation that breaks the chain of custody fails two filters at once.

Critical maintenance data in a chemical complex demands a chain of custody with a name and a signature: lockout and tagout applied and verified, line depressurized and purged, confined space with atmosphere measured, hot work authorized, permit closed and equipment returned to operation. Any automation that breaks that chain fails the safety filter and the internal audit filter, however good it is technically. And office reviews after the fact — three days later, with a cold memory — are a poor substitute for field validation with the equipment in front of you.

• Critical maintenance data in a chemical complex demands a chain of custody with a name and a signature: lockout and tagout applied and verified, line depressurized and purged, confined space with atmosphere measured, hot work authorized, permit closed and equipment returned to operation.
• An agent writing permit, isolation or inspection data without anyone having looked at it is, in this sub-sector, simply unbuyable.
• Any automation that breaks that chain fails the process safety filter and the internal audit filter, however good it is technically.
• And office reviews after the fact — three days later, with a cold memory — are a poor substitute for field validation with the equipment in front of you.

How it fits the IRIS system

The early human verification gate — two taps at the equipment, and only then does the data cross.

the early human verification gate.

This is not a concession to the safety department: it is the architecture. It is what makes the other eleven cases buyable in a plant under process safety management, because it guarantees the maintenance master is never contaminated by unsigned data. It carries no payback of its own, and we do not invent one for it.

• Everything captured by the photo, voice and parser modes lands first as a visual summary on the industrial tablet of whoever holds responsibility, at the equipment.
• What was understood is highlighted; what is uncertain is flagged as uncertain.
• Two taps: confirm or correct.
• Only then does the data cross into the central system, carrying the name of whoever validated it and the moment they did.
• Every correction becomes grounding: the system adjusts to that plant's formats, terminology and way of writing a tag, and corrections become rare.

See the full IRIS architecture →

Before and after

Validation today versus the validation gate

Aspect	Today	With iLEAN
Who appears as the author	Whoever types it, later	Whoever looked at the equipment
When it is validated	In the office, days later	At the equipment, in seconds
What the signature proves	That somebody signed	Which summary they saw and what they corrected
Unsigned data in the master	Possible	Zero, by construction
Uncertain values	Look the same as certain ones	Flagged as uncertain
What the corrections do	Nothing	Ground the system to this plant's formats

from "the AI wrote something and we'll see" to zero unsigned data in the master. From an office review days later to field validation in seconds.

Impact estimate

Estimated impact — this case carries no standalone payback.

The block below is an estimate to be validated against your plant's actual data. We put it forward so the committee has an order of magnitude; we refine it during the assessment.

• No payback of its own: this is the enabling piece that makes the other eleven cases approvable in a process safety environment.
• Its value is the risk removed: unsigned data contaminating the maintenance master, and a finding at internal audit.
• Payback is shared with the capture cases it sits behind — rounds, panels, alerts, voice, lab sheet, receiving.
• From "the AI wrote something and we'll see" to zero unsigned data in the master.

this is the enabler that makes the other eleven cases buyable in a process safety environment. Its own value is the risk removed — unsigned data contaminating the maintenance master, and failing internal audit. Payback shared with the capture cases. *Estimate to validate*.

And the fair question from the production manager

«If a person signs in the end, what is the AI saving?» — the work is not in deciding, it is in assembling. Today somebody would have to walk to a terminal, find the permit or the tag, and type. With the gate, everything arrives assembled as a summary — what was understood highlighted, what is uncertain flagged — and they confirm or correct with two taps. Extracting the fields of a permit form or an isolation list of known structure is an anchored task, where the best models drop below 1.5% error [1]; the gate exists for the remainder, and for the principle that a name goes with every datum. Every correction is stored with its author and becomes grounding, so corrections become rare.

^[1] OpenAI paper "Why Language Models Hallucinate", 2025 — on the reliability of AI in anchored tasks.