← Back to Autonomy
Systems Architecture · Agentic VHMNOTE-2026-ARCH-01

Architecture Monograph

A Human-Gated Agentic Framework for Root-Cause & Prognostic Analysis

How to replace the human analyst at the keyboard — but not the human judgment — with a closed-loop team of AI agents that finds the root cause, forecasts what happens next, and asks a person before it does anything that matters.

ScopeRCA → prognosis, closed loop
PatternHybrid · human-in-the-loop
SubstrateLLM agents + deterministic tools
GroundingThe five worked RCA case studies
In one paragraph

Across five case studies — battery fade, NVH, weld resistance, isolation faults, brake corrosion — the method never changed: define the symptom, list candidate causes, screen them statistically, reject the confounders, abduce the best explanation, confirm it with a physical signature, then forecast the future and decide what to do. This document turns that repeatable method into a framework of cooperating AI agents. Numbers are computed by real tools, not guessed by a language model; physics decides whether a cause is even possible; and a human signs off at the few points where being wrong is expensive or unsafe. The loop does not stop at the diagnosis: it forecasts remaining life, recommends a fix, watches whether the fix worked, and remembers the case for next time.

1 — What we are automating, and why gate it

The method, then the machine

The five reports all walk the same path. That path is the specification for the agents.

Every case study followed one pipeline: a symptom is observed; hypotheses are drawn from a small set of failure-mode families (mechanical, thermal, electrical, software, manufacturing, usage, environmental); a statistical screen finds what correlates; confounders are rejected by holding variables constant and by asking whether a physical mechanism even exists; the surviving explanation is reached by abduction; it is confirmed by a signature unique to the cause (a control-chart sawtooth, a diurnal peak, an order-tracking spike); the root cause is stated; a mitigation is designed; and a prognosis forecasts what happens with and without the fix.

Because the steps are explicit, they can be handed to agents. But three of them carry real consequences — declaring a root cause, approving a fix, and acting on a fleet — so those get human gates. The goal is not full autonomy; it is to do the slow, repetitive 90% automatically and bring a person in for the 10% that needs judgment or carries liability.

Three words in the title Hybrid — language-model agents do the reasoning and orchestration; deterministic tools (statistics, causal inference, physics simulators) do the calculating. Closed-loop — the system acts, then measures whether the action worked, and learns. Human-gated — at a few defined checkpoints a person must approve before the loop continues.
2 — Design principles

Seven rules that keep it honest

  1. The model plans; the tools compute. A language model should never eyeball a p-value or a remaining-life number. It decides which test to run, then calls a real function that runs it. This is what makes the system trustworthy and reproducible.
  2. Every claim is grounded. A stated cause must point to a specific tool output or data row. A verifier rejects any sentence that is not backed by evidence — this is how hallucinated mechanisms are caught.
  3. Physics is a hard gate. A strong correlation is not a cause if no physical pathway exists. The framework keeps a mechanism check that can veto a statistically attractive but physically impossible explanation (the supplier-lot trap in three of the five cases).
  4. Humans gate the expensive and the irreversible. Declaring a root cause, approving a mitigation, and acting on the fleet are checkpoints, not autonomous steps.
  5. Everything is reproducible and auditable. Versioned data, fixed random seeds, and a full trace of every agent step and tool call. If asked "why did you conclude this?", the system can replay the path.
  6. Start supervised, earn autonomy. Begin with a human approving almost everything; relax gates only for case types the system has proven it handles (see the autonomy ladder, §7).
  7. Remember every case. A resolved case becomes a retrievable memory, so the next similar symptom starts from prior experience instead of a blank page.
3 — The framework at a glance

The complete reference architecture

Read it top to bottom as authority, bottom to top as flow. People sit at the top and approve. The orchestrator plans. A team of specialist agents does the work, checked by a verification layer, computing through deterministic tools, all standing on a foundation of data and knowledge. A feedback bus along the bottom closes the loop. The diagrams below are interactive — hover or tap any block for what it does; the workflow can be played step by step, and the loop animates.

Figure 1 — Layered reference architecture
Six layers plus a feedback bus. Human gates (approvals) · orchestration & memory (the planner and the workflow graph) · the agent team (one specialist per RCA stage) · verification & guardrails (the checks that keep agents honest) · tools, now including the ingestion that turns documents into context · and at the base, data & knowledge held as both structured signals and unstructured records, fused into a feature store, a vector index, and a knowledge graph. The bottom bar is the closed loop: deploy, monitor, detect drift, learn, update the graph.
4 — The components, one layer at a time

What the framework needs

4.1 — Data & knowledge (the foundation)

Nothing works without a clean, queryable substrate — and a working version of this framework taught us that the substrate is two kinds of evidence, not one. The structured side is the numeric record: telematics and a feature store (time-series signals, measurements), build genealogy (which part, lot, station, software version went into which vehicle), and charge/cycle logs. The unstructured side is everything that does not fit in a column: service and repair notes, technical bulletins (TSBs) and engineering memos, the DTC catalog that defines each trouble code, OEM manuals and component datasheets (where the physical limits live), and prior RCA reports.

The two flow through different ingestion lanes (the tools of §4.4) into one working context. Numeric data is joined into the feature store. Documents are parsed (and OCR'd), chunked and embedded into a vector index for retrieval (RAG), and mined for entities and relationships that populate a knowledge graph; DTC codes are decoded to the subsystems they implicate. The knowledge graph then links structured genealogy to extracted facts — this VIN runs this firmware; this firmware runs the balancing routine; a bulletin references that routine — so an agent can traverse from a loose symptom to a short list of mechanistically connected suspects. A case memory of past resolved RCAs (with their signatures) and a provenance/audit store complete the layer, the latter keeping every retrieved fact tied to its source document. Practical note: most failed investigations fail here — missing genealogy, un-joined data, or unread documents — not in the reasoning.

4.2 — Orchestration & memory (the planner)

The orchestrator (a supervisor agent) turns a symptom into a plan and walks it through a state graph — the explicit workflow of Figure 2, where each node is a stage and edges include loops and human gates. It manages working memory (the current case file) and long-term memory (retrieval over past cases). Think of it as the lead investigator who assigns tasks, not the one doing every calculation.

4.3 — The agent team (one specialist per stage)

Each RCA stage becomes a focused agent with a narrow job, its own tools, and a clear hand-off. Narrow agents are easier to test and harder to derail than one do-everything agent.

AgentIts one jobTools it callsFeeds gate
TriageDefine the symptom, scope, and success criteriaData query, case retrievalG1
HypothesisList candidate causes across the 7 familiesFMEA/taxonomy KB, retrievalG1
StatisticsCorrelation screen; the four-gate testCode sandbox, stats/ML
Causal / confounderHold variables constant; reject proxiesCausal inference (partial corr, DAG)
Physics / mechanismDoes a physical pathway exist? Simulate itPhysics sim / surrogate modelsG2
ConfirmationDesign the signature test (sawtooth, diurnal…)Code sandbox, signal processingG2
SynthesisState the root cause with evidenceG2
MitigationPropose containment + corrective + robustnessKB, simulation (what-if)G3
PrognosticsForecast RUL / probability of failureSurvival models, Monte-CarloG4
ReporterGenerate the human-readable reportTemplating

4.4 — Tools (where the real computing happens)

The hybrid principle lives here. Agents call deterministic functions: a sandboxed code executor (Python with pandas, SciPy, scikit-learn), statistical/ML routines, a causal-inference toolkit (partial correlation, mediation, DAGs), and physics simulators or surrogates (thermal, electromagnetic, electrochemical). This layer also owns the ingestion tools the data layer depends on: document parsing/OCR, chunking and embedding, entity-and-relation extraction (to build the knowledge graph), a DTC decoder, and retrieval (RAG) over the vector index. The numbers in every figure of the five reports came from tools exactly like these — never from prose; and the priors, meanings, and physical limits came from these retrieval and extraction tools.

4.5 — Verification & guardrails (keeping agents honest)

This is the layer that makes the difference between a demo and a system you trust. It encodes the four-gate test as machine checks and adds grounding, uncertainty, and a critic.

Gate / checkQuestionHow it is enforced
AssociationDoes it correlate?Effect size above a set floor
SignificanceCould it be chance?p-value / confidence on held-out data
MaterialityDoes it explain enough?Variance explained (ΔR²) threshold
MechanismIs it physically possible?Physics agent must find a pathway
GroundingIs the claim backed by data?Verifier rejects uncited statements; each fact links to its source row or document
UncertaintyHow sure are we?Confidence score attached to every output
Evidence fusionDo independent streams agree?A root cause must converge statistics + mechanism + graph, not rest on one
Critic / reflectionWhat did we miss?Second agent argues the opposite case

The critic deserves emphasis: a dedicated agent whose only job is to attack the leading explanation — propose a confounder, demand the mechanism, look for the alternative. This is the structural defense against an agent falling in love with its first idea. Equally important is evidence fusion: the strongest conclusions are the ones where independent streams agree — a statistical result, a physical mechanism drawn from a datasheet, and a path through the knowledge graph all pointing the same way. A cause backed by only one stream is treated as a lead, not a verdict.

4.6 — Human gates (the people in the loop)

Four checkpoints, each an asynchronous approval with full context and a one-click override. Gates are where accountability lives.

GateBefore…The human seesCan…
G1committing to a hypothesis setsymptom, scope, candidate causesadd/cut hypotheses
G2declaring the root causeevidence, confounders rejected, mechanism, confidenceaccept / send back
G3committing to a mitigationoptions, trade-offs, simulated effectchoose / revise
G4acting on the fleetprognosis, who is affected, riskapprove / stage / hold

4.7 — The prognostics engine

Diagnosis answers "what is wrong"; prognosis answers "what happens next, and when." Once the mechanism is known, a degradation model projects it forward: remaining useful life (RUL), probability of failure over time, and the effect of each mitigation. The engine uses survival / reliability models (Weibull, Cox), physics-of-failure projections, and Monte-Carlo simulation for confidence intervals — exactly the prognosis sections of the five reports (RUL fans, escape-vs-interval curves, fault-day forecasts). Crucially, it reports uncertainty, not a single number, so G4 is an informed decision.

4.8 — Closed-loop feedback & learning

After G4, the chosen action is deployed (an OTA update, a maintenance-interval change, a field bulletin). The loop then monitors the outcome — did the fault rate fall, did Cpk rise, did the dawn fault peak vanish? It runs drift detection to catch the world changing, updates the case memory so the next investigation is faster, and re-opens automatically if the symptom recurs. This is what makes it a loop rather than a one-shot report generator.

4.9 — Observability, evaluation & governance

Around all of it: full tracing of agent steps and tool calls; an evaluation harness that replays known cases (the five reports make an ideal golden set — the system must reproduce each ground-truth root cause); cost and latency tracking; access control and audit logs; and alignment with safety and quality standards (§10). If you cannot measure whether the agents are right, you cannot relax the gates.

5 — How it flows end to end

One symptom, all the way around

The orchestrator walks the state graph below. Forward edges advance the case; the dashed edges are the loops that make it honest and closed: send-back when evidence is thin, and re-open when a fix recurs.

Figure 2 — End-to-end workflow (state graph with gates)
The investigation as a graph. Diamonds are human gates (G1–G4). The long dashed edge on the left is the closed loop — continuous monitoring re-opens the case on recurrence. A shorter loop (confirmation → hypotheses) fires when the evidence does not survive the four-gate test, sending the team back for a better explanation.

Walk the weld-resistance case through it. Triage: modules fail the resistance spec. Hypotheses: lot, electrode wear, station, energy, line speed (G1 approved). Statistics: lot and station correlate. Causal: holding electrode wear constant collapses both — they were proxies. Physics: foil resistivity is in spec, so the lot has no mechanism (veto). Confirmation: the SPC sawtooth appears, the fingerprint of tool wear. Synthesis: root cause is the dressing interval (G2 signed off). Mitigation: tighten the interval, add an end-of-line screen (G3 approved). Prognosis: escape-vs-interval curve sets the maintenance set-point (G4 approved). Deploy & monitor: Cpk rises from 0.5 to 3.6; the case is stored. The same graph would have walked any of the other four.

6 — Two views that build intuition

It is a control loop, run by a team

Strip away the detail and the framework is an ordinary feedback controller: sense, decide, act, measure, repeat — with a person holding the decision lever.

Figure 3 — The closed loop, as control
Sense → diagnose → prognose → decide → act → monitor → learn, then back to sense. The only unusual node is decide, which is a human gate rather than a pure controller — that is the whole point of "human-gated."

And the team that runs it is an orchestrator with specialists and a critic, all sharing one memory and one toolbox.

Figure 4 — Agent topology (orchestrator · workers · critic)
Supervisor-and-workers. The orchestrator delegates to specialist agents and reports to the human; a critic challenges every conclusion; all agents read and write one shared memory and call the same deterministic tools. This topology (rather than a single monolithic agent) is what keeps each piece testable.
7 — How much to automate

The autonomy ladder

Do not start at full self-driving. Climb the ladder one rung per case-type as the evaluation harness proves the system reliable. Safety-critical actions stay human-approved indefinitely.

LevelWhat the agents doWhat the human does
L0Fetch & visualize dataEverything else (the five reports were here, by hand)
L1Draft hypotheses & run the screenApproves every step
L2Full RCA draft with evidenceSigns off root cause & fix (G2–G4)
L3RCA + prognosis + mitigation proposalApproves fleet action only (G4)
L4Auto-resolve known recurring casesAudits samples; safety stays gated
Practical default Run different case-types at different levels at the same time. A well-understood manufacturing escape can sit at L3; a novel safety-relevant fault stays at L1. The gate configuration is data, not code — tune it per failure family.
8 — How it fails, and the guardrail for each

Design against the predictable mistakes

Failure modeWhat it looks likeBuilt-in guard
Confirmation biasAgent locks onto its first guessCritic agent argues the opposite; mandatory confounder search
Hallucinated mechanismA plausible-sounding but unreal physical storyPhysics gate must simulate/cite a real pathway
Confounder blindnessBlaming a proxy (the supplier-lot trap)Partial-correlation step is non-optional
Data leakage / overfitLooks great in-sample, wrong in fieldHeld-out validation; report uncertainty
Number hallucinationModel invents a statisticAll numbers come from tools, never prose
Automation complacencyHumans rubber-stamp the gateGate shows dissent/confidence; critic's objection surfaced
Silent driftWorld changes; old model still trustedDrift detection re-opens the case
Runaway cost/loopingAgents loop foreverStep budgets, timeouts, escalation to human
9 — Practical implementation notes

Building it without tears

10 — Standards & references

Further reading

Agent patterns & reasoning

  • Yao et al., ReAct: Synergizing Reasoning and Acting in Language Models (2022) — interleaving reasoning with tool use.
  • Shinn et al., Reflexion: Language Agents with Verbal Reinforcement Learning (2023) — self-critique and retry.
  • Lewis et al., Retrieval-Augmented Generation (2020) — grounding answers in retrieved evidence.
  • Anthropic, Building Effective Agents (engineering guidance on orchestrator–worker and evaluator patterns).

Agent frameworks & protocols

  • LangGraph — graph/state-machine orchestration for multi-agent workflows.
  • Microsoft AutoGen; CrewAI; OpenAI Agents SDK — multi-agent runtimes.
  • Anthropic Model Context Protocol (MCP) — standard for connecting models to tools/data; agent-to-agent (A2A) messaging for inter-agent hand-off.

Causal inference

  • Pearl, Causality (2009); Pearl & Mackenzie, The Book of Why (2018) — confounding, mediation, do-calculus.
  • DoWhy and EconML — practical causal-effect estimation libraries.

Prognostics & condition monitoring

  • ISO 13374 — condition monitoring & diagnostics of machines (data processing & presentation).
  • ISO 13381 — prognostics for condition monitoring.
  • Saxena et al., Metrics for Evaluating Performance of Prognostic Techniques (NASA, 2008) — RUL accuracy metrics.
  • Survival/reliability analysis: Weibull and Cox proportional-hazards models (e.g. the lifelines library).

Functional safety & quality (for the gates)

  • ISO 26262 — road-vehicle functional safety (why fleet actions need a human gate).
  • Automotive SPICE; IATF 16949 — process & quality-management discipline.
  • AIAG-VDA FMEA Handbook — the failure-mode taxonomy the Hypothesis agent draws on.

References are pointers for further reading; titles and editions are given at a stable, conceptual level rather than as live links.