At a remote site, the person accountable for the operation is the person on site. The plant manager, the master of the vessel, the shift supervisor in the control room. When something goes wrong, they act, and they answer for what they did.
AI changes that only if we let it. If stopping a model needs a vendor login, a cloud console or a link that is down, the person accountable is no longer the person in control. This post sets out what operator control for AI at remote sites actually means, and the audit trail that proves it was exercised.
What is operator control?
Operator control is the ability of the people accountable for a site to stop, change and roll back the AI running there, on their own authority, at the site, with or without a network link. It is the AI version of a principle operational technology has held for a long time: the operator can always take the system to a safe state.
The NIST guide to operational technology security is built around that principle for industrial systems. The NIST AI Risk Management Framework and ISO/IEC 42001 ask for defined roles, human oversight and the ability to intervene. Operator control is where those ideas meet at a site.
The four controls an operator needs
Operator control comes down to four things. Each one should work at the site, with the link down.
1. Stop
An operator must be able to take a model out of the decision path at once and put the system into a defined fallback. That fallback is decided in advance: manual operation, a rules-based process, or a previous approved model.
A stop that is not tested is a hope. Rehearse it on a schedule, the same way sites test fire alarms and emergency shutdowns, and record each rehearsal.
2. Approve or refuse a change
Nothing about the model at a site should change without someone at the site, or someone with delegated authority, approving it. That covers the model weights, the version, the prompts and system instructions, retrieval data that shapes answers, and the settings that govern how the model is used.
Updates can be prepared elsewhere and delivered when the link allows. They should wait, staged and verified, until an approved person at the site accepts them. A vendor pushing a change straight into production at a critical site has taken a decision that belonged to the operator.
3. Roll back
If a change goes wrong, the operator must be able to return to the last approved version from the site, without downloading anything. That means the previous version stays on disk, verified and ready, until the new one has proven itself.
4. Hold the keys
Whoever holds the keys holds the control. Signing keys decide which models and updates a site will accept. Credentials decide who can stop or change the system. If those keys sit only with a vendor, the operator has delegated control whether they meant to or not.
Operators should hold, or at least co-hold, the keys that authorise changes at their sites, with clear procedures for rotation and for revoking access when people or suppliers change.
Why a cloud kill switch is not enough
Many AI systems offer a stop in a web console. That is useful when the site is connected. It is not operator control.
The moment you most need to stop a model is often the moment something else has gone wrong too. The link is degraded, the vendor’s console is unreachable, the people who can log in are asleep in another time zone. A remote stop can be a good addition. It cannot be the only path, and it cannot sit above the operator’s own authority.
The test is simple. Disconnect the site and ask the operator to stop the model, roll it back and show who changed it last. If any of those fail, control sits somewhere other than the site.
The audit trail: proving control was exercised
Control that leaves no record cannot be checked. An audit trail turns operator control into something an auditor, a regulator, an insurer or an incident review can verify.
What it should record
| Event | What to record |
|---|---|
| Model installed or updated | Model name, version, checksum, signer, who approved, when |
| Configuration change | What changed, old and new values, who approved |
| Stop | Who stopped it, when, reason, fallback used |
| Restart | Who restarted it, which version, when |
| Rollback | From which version to which, who, why |
| Access change | Credential issued, rotated or revoked, by whom |
| Stop rehearsal | When, who, whether the fallback worked |
How to keep it trustworthy
- Keep it at the site first. The record must be written even when the link is down, then copied off the site when the link returns.
- Order it. Every entry gets a sequence number as well as a timestamp, so order survives clock drift. NIST log management guidance treats ordering and integrity as basic requirements.
- Make tampering evident. Chain entries by hash so a missing or altered entry shows. Append-only logs built on hash chains, as in Certificate Transparency, show how this can be done at scale.
- Sign it. Entries or batches signed with a key held at the site let a third party confirm where the record came from.
- Make it readable by others. The record should be exportable in a plain format and checkable without the vendor’s tools.
Questions to ask an AI supplier
Before you put AI into a remote site, ask:
- Can our operators stop the model at the site with no network link?
- What does the system fall back to when stopped, and who decides that?
- Can any change reach the site without our approval at the site?
- Can we roll back to the last approved version without a download?
- Who holds the signing keys that decide what the site will run?
- Does the system need to contact you to keep working, for licensing or anything else?
- Is the audit trail written at the site, ordered, tamper evident and signed?
- Can an auditor check the record without your tools?
A supplier who answers each of these plainly is offering operator control. A supplier who needs a call to explain is offering something else.
Where Sector88 fits
Sector88 is one system to deploy, run and govern AI at every site, connected or completely cut off. Control sits with the operator, under the operator’s command, at the site.
The principle is old and it still holds. The person accountable for the site must be able to stop what runs there. AI does not get an exemption.