CrossnoKaye AURA: Physical AI on Amazon Bedrock AgentCore in Plants

Industrial plants do not look like SaaS tenants. Historians, PLCs, SCADA screens, and vendor-specific tag names sit in silos, and control logic that actually trips equipment is often locked in proprietary controllers. CrossnoKaye's answer is to own the plant model first, then add agents on top. In a November 9 AWS Machine Learning Blog post, the company describes AURA on ATLAS, using Amazon Bedrock AgentCore code interpreter sandboxes so large language models plan investigations while Python in microVMs produces checkable numbers.

CrossnoKaye reports more than 100 facilities, 13,000 controlled assets, 22 trillion stored machine data points, and 50 billion new readings per day. Those scale figures come from the company via AWS; the architectural lesson is how they prevent hallucinated math in production physical AI.

TL;DR

ATLAS, AURA, and AgentCore on AWS

Amazon Bedrock AgentCore is the AWS platform for running agents in production with any framework or model. CrossnoKaye builds ATLAS and AURA on top of it.

CrossnoKaye ATLAS edge clusters and AURA agents on AWS with Amazon Bedrock AgentCore Image: AWS

The AWS post's Figure 1 shows how on-premises ATLAS edge clusters stream telemetry through VPC Lattice and MSK, while AURA on EKS coordinates Bedrock inference, AgentCore Python sandboxes, and cited Brief delivery over SES.

Why bolt-on plant chatbots fail

The AWS post argues external agents fail because:

• Every OT system uses different tag naming
• Safety interlocks are invisible to outsiders
• Credentials spread across the plant network when agents need broad access

CrossnoKaye already stores topology, control narratives, interlocks, historian tags, alarms, optimizer state, and documentation in one platform boundary. AURA reads that unified graph through an Atlas Data gateway under enterprise permissions, then calls foundation models through a Model Gateway with Amazon Bedrock Guardrails.

That is the same design principle as Okta Cross App Access with AgentCore Gateway: one front door for tools and data, not ad hoc MCP credentials on every PLC VLAN.

The quarry example: topology beats timestamps

Anthropic's November 9 electronics research is CAD-heavy; CrossnoKaye's story is operations-heavy. When a quarry's secondary crusher tripped repeatedly, historian timestamps implied the secondary unit faulted right after the tertiary crusher, so operators chased a crusher problem.

Because AURA also reads conveyor layout and interlocks, it followed control logic: a slipping recirculating belt under the tertiary crusher tripped overload protection, which upstream-interlocked the secondary crusher to avoid burying stone. The fix was belt inspection, not crusher rebuild.

That only works when the agent's context includes deployed base control narratives, not just alarm CSV exports. If your agent only sees tags, it invents physics.

AgentCore sandboxes: warm chats versus clean jobs

AURA uses Amazon Bedrock AgentCore differently by workflow:

For a fleet alarm triage across 94 plants, Python in the sandbox grouped activations by facility and rule, separating chattering tank alarms from sites with cascading faults in the same second.

Verifiable computation contract

Early AURA prototypes let models print JSON summaries; CrossnoKaye found column drops and window mistakes too often. The production pattern:

1. Validate input contracts and stage up to 50 datasets into the sandbox.
2. Append a harness that requires pandas DataFrames with declared columns.
3. Serialize verified tables to Apache Parquet, not stdout prose.
4. On exceptions or schema mismatch, Temporal retries with the traceback as a structured prompt.

No unverified number reaches a Brief email. That is the industrial version of "don't trust LLM arithmetic," similar in spirit to semantic caching guards for cost, but here the stake is safety narratives.

Numbers flow to Amazon S3 artifacts; engineers get HTML Briefs through Amazon SES with inline citations validated against saved telemetry windows.

Routines: four minutes from drift to inbox

A 2:00 AM refrigeration drift Routine shows the full chain: detection, read-only Task, sandboxed root-cause analysis correlating condenser approach and suction pressure, citation validation, then SES delivery with an Investigate in AURA button that reopens a Chat preloaded with evidence.

CrossnoKaye stresses no automatic control changes from Routines. Proposals in interactive mode need human approval under corporate SSO.

Defense in depth on real equipment

CrossnoKaye lists four independent safety layers:

1. Bedrock Guardrails on prompts and completions, org-scoped RAG, citation requirements.
2. Read-only sandboxes with no network path to field gear; Routines stay read-only.
3. Deterministic edge base control in local Kubernetes: rate clamps, bounds, interlocks cloud cannot bypass.
4. Hardwired machinery protection beneath software.

Cloud optimization sends schedules within envelopes; it does not drive valves directly. Compare that to agent demos that toggle APIs without a non-bypassable floor.

For agent governance patterns on AWS, see AgentCore payments and x402 and Claude Code remote sessions on AgentCore. When agents touch production systems, AgentBeam stops AI agents before they take dangerous actions.

Claimed outcomes

From the AWS post, attributed to CrossnoKaye:

• 11–17% production throughput improvement and ~21% average energy cost reduction from APC applications
• 34% lower batch drying-time standard deviation with 6% more product in yield spec at one site
• 50,000+ tons/year recoverable production gap identified in quarry operations
• 5,000+ AI agents monitoring 10,000+ plant assets
• Investigations that took hours of CSV and ladder logic work completing in under four minutes with cited Briefs

Treat these as customer case metrics from the vendor, not independent audits.

Lessons for builders outside food and refrigeration

1. Unify the plant model before the chat UI. Without topology and interlocks, agents optimize the wrong failure mode.
2. Embed in shift workflow. Overnight Routines plus morning Briefs beat a blank prompt portal engineers never open.
3. Never ship model math for OT. AgentCore or your own sandbox must return schema-checked artifacts.
4. Assume edge authority. Cloud agents propose; edge controllers enforce.

Physical AI also shows up in NVIDIA and Korea sovereign AI and Berkeley agentic robotics at CoRL; CrossnoKaye is the continuous process industry reference for the same decade-long trend.

AWS services named in the architecture

The case study is also a service map for teams already on AWS:

Edge appliances run local Kubernetes with outbound-only connectivity, so cloud loss does not stop safe base control. That pattern mirrors how Norway paused data-center licensing while keeping critical loads running locally, but here the locality requirement is milliseconds, not policy.

Chats, Tasks, and Routines in operator language

CrossnoKaye names three interaction modes:

• Chats for interactive debugging when an engineer explores hypotheses.
• Tasks for repeatable analyses with pinned prompts and tools.
• Routines for unattended watchers on thresholds, rates of change, alarms, or mode transitions.

The distinction matters for capacity planning. Chats want warm sandboxes; Routines want cold, auditable runs. Mixing them in one pool causes either cost bleed or stale state bugs.

MCP clients can call the same gateway as human engineers, per the architecture diagram, which pushes credential governance back to the API gateway and SSO layer instead of scattering keys on the plant floor.

Comparison to generic RAG on historian exports

Many pilots do CSV export RAG: dump tags, embed chunks, ask questions. CrossnoKaye argues that fails because:

• Tag names lack topology and interlock semantics.
• Summaries hallucinate integrals over millions of rows.
• There is no citation tie-back to time windows operators can audit.

AURA's Parquet contract is the technical fix: the model writes code, the harness verifies schemas, and Briefs cite artifact IDs operators can open. That is more engineering than a vector database tutorial, but it is what regulated plants will ask for.

When this pattern is overkill

If you run a single-line site with one historian and no closed-loop optimization, replicating ATLAS is unrealistic. Start smaller: read-only AgentCore sandboxes on exported data, human-approved suggestions, and explicit refusal to auto-write setpoints. Grow toward CrossnoKaye's four safety layers only when you control both cloud and edge control code.

For regulated industries, pair this architecture with audit logs that tie each Brief citation to immutable Parquet blobs, not chat transcripts alone. That is the evidentiary bar safety teams will ask for once agents leave the demo account.

CrossnoKaye also reports 650,000 closed-loop control actions per day and 9,000 control software deployments per year with zero claimed safety incidents on base control. Agents sit on top of that operational core, not instead of it.

Related reading

• Okta and AgentCore Gateway governance
• AWS Agent Registry and MCP discovery
• Serverless MCP on ECS for data lake agents
• Claude electronics design with Fable 5.2
• Meta Muse Ember for high-volume agent steps
• Agent sandboxes for coding agents

Architecture details follow CrossnoKaye's November 9, 2026 post on the AWS Machine Learning Blog.