Siemens CEO Roland Busch has a complaint about AI that most vendors would rather not hear. Ask the same question twice and you get different answers. On a chat interface that is mildly irritating. On a production line that has already shipped hardware, it is a recall.
Siemens automates roughly one in three manufacturing lines worldwide. Busch's framing at a Salesforce event was blunt: "failure is not an option. You cannot launch a product, manufacture it, send it to the field, and find out it doesn't work." Design, production, and operation all have to be deterministic.
The obvious answer is to make the model deterministic. Nobody is doing that. Three deployments worth looking at this week, Siemens with Salesforce, Cadence with NVIDIA, and Shield AI with Kraken, all solve the problem the same way: keep the model probabilistic and move the guarantees into the surrounding system.
Siemens puts agents behind a qualification gate
Siemens uses Salesforce as the single source of truth for customer data, alongside Teamcenter for product and manufacturing data. The inbound sales funnel was the first target. Siemens was receiving over 2,500 unqualified leads a month with no reliable way to tell which were worth pursuing.
Salesforce's Piper voice agent now handles that. Leads land in Sales Cloud, an engagement agent reaches out using CRM data to personalize the email, and a qualification agent vets each one. It can pull the lead's sales history, confirm or add details, and record budget and timeline as the conversation progresses. Qualified leads get routed to a human.
The supplier side is more interesting. Siemens has 120,000 suppliers and 65,000 partners. Onboarding used to involve static forms and a wait. Piper now builds a personalized pitch and books qualified partners with an account manager, while Marshall, the operations agent Salesforce got through its Regrello acquisition, finishes the onboarding steps in SAP without a human in the loop.
Note where the determinism lives. The agent decides who to contact and what to say. SAP decides what state the partner record ends up in. Busch's phrase about "embedded bonuses," which I read as a transcription artifact for guardrails or bounds, describes exactly this split. He also makes a point that gets skipped in most agentic AI coverage: embedding this stuff deeply in a workflow changes the user interface and the process, not just the tooling.
Cadence and NVIDIA separate reasoning from permission
Cadence and NVIDIA went further and gave the split names. Reasoning authority is what the agent decides to do next. Engineering authority is the evidence about whether the decision was right. Execution authority is the permission to actually do it.
ChipStack AI Super Agent sits on the reasoning side. Xcelium Logic Simulator and Jasper Formal Verification produce the evidence. NVIDIA's stack produces the permission. OpenShell establishes a runtime boundary around the agent, and Sentry runs on BlueField-4 DPUs as an out-of-band watchdog that can quarantine an agent in milliseconds if it tries to leave its lane. Vera CPU handles agent execution.
The performance number is 40X faster RTL validation on a workflow at NVIDIA, taking a verification loop that normally runs five weeks down to under a day. Treat that number like any vendor benchmark, since it describes one connected simulation, formal analysis, debug, and RTL modification loop rather than chip design in general. The architectural point holds anyway: an agent can determine that RTL should change without holding unrestricted permission to modify files or spawn arbitrary processes. Those are separate questions, and conflating them is how you end up with an agent that deletes a verification environment at 3am.
Shield AI and Kraken test the same idea at sea
Shield AI and Kraken Technology Group demonstrated Hivemind running on two K3 SCOUT uncrewed surface vessels in Portsmouth on September 28. The vessels coordinated an ISR search across a designated area using onboard radar, cameras, and AIS data, classified a vessel of interest, tracked and escorted it, then replanned and resumed the search. Two boats, one mission, sensors shared.
Hivemind is Shield AI's autonomy pilot, previously used on V-BAT and X-BAT aircraft. This was its first maritime demonstration in the UK. The K3 SCOUT is 8.4 meters long, does 55 knots, and carries 600 kg of payload. Kraken delivered 20 of them to the Royal Navy under Project BEEHIVE and raised a $175m Series B at a $1bn valuation.
The distinction Hivemind draws is between an autopilot that follows a fixed route and an agent that reroutes, avoids obstacles, and handles unexpected conditions within operator-defined parameters. Human decision authority stays, per Shield AI's release. Boundaries again, just enforced by command authority instead of a DPU.
What this means if you are deploying agents
Decide where the boundary is before you pick a model. A model that can call a tool is not an agent you can ship. The failure mode is the same in all three cases: an agent with more permission than the task requires. Siemens limits what the agent can write to. NVIDIA limits what process the agent can start. Shield AI limits what the vessel can do without a human in the chain.
Two honest caveats. Governance layers add latency, and a DPU-based watchdog is not free infrastructure. And none of this makes the model itself reliable. It bounds the blast radius of a bad decision, which is a weaker claim than "AI you can trust" and a far more useful one. If your current agent design relies on the model being correct rather than the system being constrained, you have not built autonomy. You have built a liability with a nice demo.
Siemens, Shield AI, and Kraken all say they plan further trials in live or contested environments over the coming year. That is where these boundaries get tested properly, and where we will find out which of the three actually holds.