Evidence-Governed Deployment Readiness for Networked Agents on Industrial OT Infrastructure

Abstract: Deploying a workload on a cyber-secure industrial operational-technology (OT) network requires many cross-layer prerequisites to hold at once, including persistent addressing, name resolution, time synchronization, certificate trust, proxy traversal, and reachable industrial-protocol endpoints. These are owned by different teams, yet current tools treat pre-deployment checking, fault attribution, remediation, and ongoing compliance as separate problems, so evidence is rarely reused across stages. As edge platforms come to host self-adapting agents on shared infrastructure, this fragmentation becomes a governance problem. All four stages ask one question: do a workload's requirements hold on a given network? We present an evidence-governed framework that answers it through a single reference, a versioned network-intent artifact specifying a workload's cross-layer requirements for a specific release. A coverage-driven test loop attaches tested evidence to each requirement before deployment. At a site, readiness is reported as ready, not ready, or undecidable, separating untested requirements from genuine failures; a repair step proposes fixes that preserve co-located workloads; and a drift-watch component re-evaluates the site on change, extending assurance across the workload's lifetime. A multi-workload OPC UA commissioning case illustrates all four stages. By detecting runtime deviations and suspending an agent's guarantees until a refreshed artifact is registered, the framework grounds auditable governance for adapting agent collectives on shared industrial infrastructure.