Apprentice.io

The counterparty list is named by system class, and it reaches below the application layer: "A1 agents and workflows execute across your entire manufacturing tech stack: ERP, MES, QMS, EAM, SCADA, historian, PLCs, IoT, and flat files." SCADA systems, historians and PLCs are plant control and instrumentation, not SaaS APIs, and reaching them is a harder integration problem than a REST connector.

The protocols are named, and they are the right ones: "connect point-to-point or through a middleware with webhooks, MQTT or OPC-UA." OPC-UA is the industrial interoperability standard for machine data and MQTT the publish subscribe transport used across plant floors; naming both describes real equipment connectivity.

The verb is execute, not read. Agents execute across that stack, and the published work is transactional: generating CAPAs and deviations into the quality system, guided execution against the MES, alarm management against SCADA. Writing a deviation into a validated QMS is an authenticated write into a system of record.

The plan table shows it ships. The Team tier lists "all connectors (MES, ERP, QMS, SCADA, IoT and more)," plus an on premises A1 connector for integrations and PrivateLink connectivity for reaching systems behind a plant firewall. Both are integration topology rather than deployment options. A dedicated integrations page exists at apprentice.io/platform/integrations, and Apprentice's 2025 release notes name Veeva SOP and Blue Mountain as counterparties.

Sourceapprentice.io/product/a1-agent connectors section and Team plan feature listread 2026-09-13

The vendor leads with a documented, durable, customer composable workflow layer: "A1's agent and workflow capability allows you to define the exact steps and actions A1 should take every time it runs," under a heading promising a "repeatable, consistent and compliant workflow every time." Defined multi step sequences that persist across runs are orchestration in the strict sense, not a chain assembled per request.

The plan table prices it. The Team tier includes "unlimited custom agents and workflows" and "pre-built cross-team workflows," and the free tier carries "pre-built agents and workflows matched to your role." Cross team is the multi actor case: a workflow spanning quality, production and supply chain crosses organizational handoffs.

Execution is cross system and transactional. Agents and workflows execute across "ERP, MES, QMS, EAM, SCADA, historian, PLCs, IoT, and flat files," and the published tasks are procedures rather than lookups: deviation investigation, CAPA generation, audit readiness checklists, shift handoffs, OEE analysis, alarm management and tech transfer.

The determinism constraint is a design choice, not a ceiling. "You can't afford to let AI make up a new workflow every time it runs" limits improvisation, and in a validated GMP environment a fixed, repeatable multi step sequence is the harder engineering problem.

Sourceapprentice.io/product/a1-agent, apprentice.io/product/platform/servicesread 2026-09-13

The grounding sources are real and named, but no retrieval structure, index or citation is documented.

The agents read the customer's live operational estate through named connectors ("ERP, MES, QMS, EAM, SCADA, historian, PLCs, IoT, and flat files"), and the free tier includes multi file upload, so procedures and documents are ingested deliberately as well as read from systems. A1 then produces grounded artifacts, "CAPA reports to process summaries," and worked examples include "analyze all alarms from the past 30 days" and "build an audit readiness checklist," both of which require reading a body of historical operational data. A historian is by construction a maintained time series store.

Nothing describes an index, embeddings, semantic retrieval, a knowledge base product or a citation trail. The historian and the MES are the customer's systems of record that A1 queries; reading somebody else's database is integration. No retrieval layer that Apprentice maintains over that material is described.

The citation gap matters more here than usual: a CAPA report is a regulated document, and under 21 CFR Part 11 a reviewer needs to trace an assertion to its source record. Nothing published shows A1 doing that.

Sourceapprentice.io/product/a1-agent, apprentice.io/product/platform/servicesread 2026-09-13

The security page gives the gate its own heading, Human-in-the-Loop: "Our AI agents operate within rule-based boundaries, keeping humans as final decision-makers for GMP-related actions. This ensures a clear accountability chain aligned with regulatory expectations, delivering the efficiency of AI while preserving essential human oversight in regulated environments." Final decision makers is a reservation of the decision to a person on the class of actions that matter, stated as a design constraint.

Three independent layers of oversight are present. One, the decision gate above. Two, an administrative entitlement: "Permission to AI features is controlled by system admin ensuring only approved employees have access," oversight set before the fact, deciding who may invoke an agent at all. Three, output review as the normal path: A1 generates CAPA reports and process summaries "that you can review, edit, and share with your team," so the artifact reaches a person before it reaches the record.

The determinism constraint reinforces it: "A1's agent and workflow capability allows you to define the exact steps and actions A1 should take every time it runs." Bounding what an agent may do is a different control from approving what it did, and both are present.

The regulatory frame makes the gate credible: 21 CFR Part 11 requires attributable electronic signatures on GMP records, so a human decision maker is a legal requirement here.

No approval queue, escalation path or per action risk tiering is published, and nothing publicly defines where GMP related actions end and everything else begins.

Sourceapprentice.io/platform/security-compliance Human-in-the-Loop section, apprentice.io/product/a1-agentread 2026-09-13

The security page carries both independent attestation and customer facing access controls.

The page lists "SOC 2 Type II certified" and "ISO 27001: 2022 certified," each with its own heading and badge, described as "a well-defined and independently verified information security management system," with GDPR alongside. Certified and independently verified are the asserted form, not a designed to comply hedge.

SSO has its own section, which reads "Our platform seamlessly integrates with major SSO providers in order to maintain secure, centralized authentication... using existing corporate credentials," with robust permission settings, multi factor authentication and continuous monitoring listed beside it. Federation plus a permission model plus MFA is a customer facing control surface.

The agent specific control is unusually explicit: "Permission to AI features is controlled by system admin ensuring only approved employees have access." An administrator gates who may use the agents at all.

GMP compliance, validated systems, batch records and audit readiness are quality and inspection postures rather than information security controls, and cGxP and 21 CFR Part 11 conformance governs records and audit trails.

Sourceapprentice.io/platform/security-complianceread 2026-09-13

The agents execute inside the electronic batch record, so the production record is the record of what the agent did: an operator step and an A1 step land in the same validated document.

The regulatory frame makes it an audit trail rather than a log, and the vendor states the standard: "Apprentice meets cGxP standards and 21 CFR Part 11 requirements." Part 11 governs electronic records and signatures, and its central requirement is attributable, time stamped, computer generated audit trails that cannot be obscured: who did what, when, and to which record. Asserting Part 11 conformance asserts that trail exists over everything the platform writes. Continuous monitoring is listed alongside permission settings and MFA on the same page.

The agent's own output is inspectable: "A1 generates real manufacturing documents, from CAPA reports to process summaries, that you can review, edit, and share," and published tasks include "create an operational dashboard" and "analyze all alarms from the past 30 days," which read back over retained operational history.

No agent specific surface is documented. There is no run history view, reasoning trace, per agent activity log or export of agent actions as distinct from batch data. Agent actions are covered only because agents write into the batch record that Part 11 governs, which the page implies rather than states. A buyer asking which agent did this and why has the record, not necessarily the reasoning.

Sourceapprentice.io/platform/security-compliance, apprentice.io/product/a1-agentread 2026-09-13

Apprentice documents no memory layer for A1. Process knowledge, run summaries and recommendations look like memory and are not. Process knowledge is the corpus the agents read (procedures, historian data and uploaded files). Run summaries are the production record: "A1 generates real manufacturing documents, from CAPA reports to process summaries," artifacts the agent produces for people. Recommendations to optimize the next run are an analytical output; a report suggesting an improvement does not mean the agent carries anything forward.

There is no per user or per site memory scope, no published lifetime, no expiry or purge path and no read or write surface, and nothing describes cross session recall. No named memory component is published.

The product design points the other way. A1's headline promise is determinism, not accumulation: "You can't afford to let AI make up a new workflow every time it runs. A1's agent and workflow capability allows you to define the exact steps and actions A1 should take every time it runs." A validated GMP agent that behaved differently on run two because it remembered run one would be a compliance problem, so repeatability is the feature and remembering is designed out.

Sourceapprentice.io/product/a1-agent, apprentice.io/platform/security-complianceread 2026-09-13

Nothing names a place or offers a choice. Delivery is described as a fault tolerant, geographically redundant cloud, and those are reliability properties rather than deployment topology: they describe how the vendor protects uptime, not where the software runs or what the buyer may choose. No region, region list, country, cloud provider, tenancy model, self hosted platform option or selection surface is published, and no residency is claimed at all.

Two Team plan items look like deployment and are not. The "on-prem A1 connector for integrations" is a customer hosted component that reaches equipment behind the plant firewall; it is how the platform talks to PLCs and historians, not where the platform runs, and "for integrations" is the vendor's own scoping. "PrivateLink connectivity" is a private network path into the same cloud service; it changes how traffic reaches a tenant, not where the tenant sits. Both are network topology.

The GDPR claim is not residency either: protecting personal data in line with EU law is a legal posture, not a statement that data sits in the EU.

Apprentice also runs a trust center at apprentice.io/learn/trust-center.

Sourceapprentice.io/product/a1-agent plan table, apprentice.io/platform/security-complianceread 2026-09-13

The site publishes five agents, each with its own page under an AI Agents navigation section: Process Agent, Quality Agent, Continuous Improvement Agent, Scheduling Agent and Authoring Agent, alongside the A1 Agent itself.

The catalog is browsable and each entry has a durable URL. Each agent stands on its own: without the Scheduling Agent, the Quality Agent is still a whole product doing unrelated work.

The services page shows them as selectable units with worked tasks attached ("create an operational dashboard," "build an audit readiness checklist," "generate a CAPA report," "create a troubleshooting guide," "analyze all alarms from the past 30 days"), grouped under named capability areas including OEE Analysis, Recipe Authoring, Tech Transfer Acceleration, Process Monitoring, Alarm Management, Deviation Investigation, Audit Readiness and Shift Handoffs.

They do work when selected. The free tier includes "pre-built agents and workflows matched to your role," and the Team tier adds "pre-built cross-team workflows," so prebuilt units are an entitlement a buyer receives, not a gallery to look at.

Sourceapprentice.io AI Agents navigation, apprentice.io/product/a1-agent plan tiers, apprentice.io/product/platform/servicesread 2026-09-13

The product page states it as the product's defining claim: "A1 is not a chatbot. It proactively responds 24/7 to alarms, events, schedules, file changes and more. Production doesn't wait for a prompt. A1 can be configured to proactively respond to triggers." That names four distinct classes in one sentence: alarms, events, schedules and file changes.

The plan table makes it a shipped, priced feature: the Team tier lists "triggers (webhook, MQTT, schedules)." A webhook is an inbound event surface, MQTT an industrial publish subscribe subscription, and schedules a clock.

The industrial event sources are distinct from software events. Alarms and tag changes arriving from SCADA, historians and PLCs over MQTT and OPC-UA are machine generated, continuous and unattended; the plant fires them whether anyone is logged in or not.

Channel coverage is broad as well, reaching "email, SMS, WhatsApp, Slack, Teams, and more," with the rationale "when an issue happens on the floor, the last thing you want is to have to log in to an app." Messaging is listed on the Team tier alongside triggers.

Sourceapprentice.io/product/a1-agent triggers section and Team plan feature listread 2026-09-13

The vendor chooses, exclusively. No model, provider or family is named. There is no model selector, admin entitlement over models, per request choice, disclosed routing or bring your own model path in any tier, Enterprise included.

What is named is the vendor's own versioned stack: "A1 Agent, powered by Apprentice 4.1," repeated in the page metadata. That is Apprentice's product version, presenting its intelligence as proprietary rather than as an assembly of third party models. The base models underneath are not disclosed, so a buyer cannot learn which model reads their batch records. A vendor that names a single provider makes the absence of choice visible; this one names none, so the same lack of choice comes with less disclosure.

The determinism positioning explains it: "trained and constrained for manufacturing," and "you can't afford to let AI make up a new workflow every time it runs." A vendor selling validated, repeatable behavior into a GMP environment has a coherent reason to fix the model stack, since swapping models would invalidate qualification. The reasoning is coherent, and the buyer still has no say over the model.

Sourceapprentice.io/product/a1-agent, apprentice.io/platform/security-complianceread 2026-09-13

A customer can extend what A1 reaches and what it does, but nothing documented lets an outside system drive A1.

The Team tier sells "unlimited custom agents and workflows" as a priced entitlement, so a customer authors new agents and multi step workflows rather than choosing from a fixed set. Alongside it, "triggers (webhook, MQTT, schedules)" and an "on-prem A1 connector for integrations" let a customer wire the platform into systems Apprentice never shipped a connector for, and OPC-UA and MQTT are open standards a customer's own equipment speaks.

No API or SDK for Apprentice's own platform is published: there is no developer portal, REST or GraphQL reference, SDK, CLI, MCP server or A2A card. There is no docs or dev subdomain. The page titled "Tempo training service & documentation" at /product/platform/services is a training and services page, not a developer reference, and the footer, which covers Products, Platform, Learn, Company, Industries, AI Agents and Legal, has no developer entry.

The webhook direction matters. Webhooks are listed under triggers, meaning A1 receives them. A surface that lets an external system notify A1 of an event is not an API that lets an external system command A1, query its state or build on it. A1 is reachable at a1.apprentice.io as an application, not as a platform.

Sourceapprentice.io/product/a1-agent Team plan feature list, apprentice.io full footer navigationread 2026-09-13

What is claimed is simulation of a manufacturing procedure, not a harness that tests the agent. AI can simulate a procedure run before execution to estimate time and surface improvements, which is process simulation rather than an agent testing surface.

Simulating a procedure before it runs against real material is pre deployment testing of a change, but the feature is not documented as testing a change to the agent. The simulate before you run capability belongs to the Tempo Manufacturing Cloud and MES products and is not described on the A1 product or security pages.

No agent evaluation is published. The free Proof of Concept tier is a commercial trial, not a test harness. "Define the exact steps and actions A1 should take every time it runs" is determinism, not testing. Review and edit of generated CAPAs is per output oversight. "Predictable quarterly software updates and releases" is a release cadence, not a customer run evaluation. No scored cases, regression suite, A/B comparison of agent configurations or published quality metric appears.

Sourceapprentice.io/product/a1-agent, apprentice.io/platform/security-complianceread 2026-09-13

None of the three modalities is documented: no hosted or local browser session the agent drives, no desktop control and no remote or local computer control.

The platform lists its access routes, and every one is programmatic: "A1 agents and workflows execute across your entire manufacturing tech stack: ERP, MES, QMS, EAM, SCADA, historian, PLCs, IoT, and flat files," connected "point-to-point or through a middleware with webhooks, MQTT or OPC-UA."

Those are machine to machine protocols, and OPC-UA exists precisely so that software does not have to drive an operator screen. A SCADA vendor could redesign its HMI entirely and A1 would be unaffected.

This is the sector where the opposite might be expected. Pharmaceutical plants run decades old equipment and instrument software with no modern interface, and screen automation is a common answer to that problem. Apprentice takes the other route: speak the industrial protocols, and put an on premises connector inside the plant firewall to reach equipment directly. The absence is architectural rather than an omission.

Two features come close and are not computer use. Chat on "web, iOS, Android and desktop" is the product's own client across form factors, not an agent operating someone else's interface. Guided execution on wearables and mobile places a person in front of a screen while the agent supplies the instructions, which is the inverse of an agent operating a screen. Reading and writing flat files is a data path, not interface operation.

Sourceapprentice.io/product/a1-agent connectors section, apprentice.io/platform/security-complianceread 2026-09-13