Federation Architecture: A Safer Path to IT-OT Convergence in the AI Era

extract

Federation Architecture: A Safer Path to IT-OT Convergence in the AI Era Davoud Shahlaei explains how Federation architecture balances IT-OT convergence benefits with safeguards while mitigating AI-driven risks while enabling centralized insights. Siloed operations increasingly limit the efficiency required by modern workloads, and the integration of information technology systems with operational technology systems (IT-OT convergence) is the remedy. However, fully converged IT-OT architectures introduce a risk profile that many operators struggle to justify. As AI adoption accelerates, that risk becomes more acute, especially when convergence creates automation hooks across the IT to OT boundary. AI-driven workloads push organizations toward convergence and increase the need for shared infrastructure, shared data, and centralized insight. At the same time, AI introduces a cross-disciplinary risk that only becomes visible when IT security, OT safety, and emerging AI risk perspectives are considered together. The challenge lies in introducing convergence without compromising the safety and control foundations of OT environments. The Value of IT-OT Convergence IT-OT convergence is sometimes presented as the goal or the inevitable trend, but it is really a means to an end. It enables unified intelligence across the infrastructure stack and sites. A frequent benefit is the elimination of blind spots. When power, cooling, and IT signals are available in a single view, operators can spot cross-domain issues faster, for example, by correlating a cooling fault affecting a server row with a spike in network latency or CPU throttling. Beyond visibility, convergence enables coordinated optimization. With higher-density workloads pushing thermal margins, manual or siloed management of power and cooling becomes harder to sustain. Proponents might argue that integrated systems can support faster operational response and efficiency improvements, especially when insights and planning extend across multiple sites from a central command center. However, combining IT-OT convergence with the realities of OT environments remains challenging and has sparked ongoing debates. Status of the Debates Full convergence is not as widely accepted as some assume. The debate is not about whether central visibility is useful. It is about how far enterprise IT should extend into OT systems that control physical processes. A key reason is the structural mismatch between IT and OT. While IT is optimized for agility and frequent change, OT is optimized for deterministic behavior, availability, and long lifecycles. These differences create friction when IT practices expand into OT environments. The risk is also asymmetrical. IT outages are often recoverable through restoration and rebuilding. OT failures can damage physical assets and can be harder to reverse. IT designs a security response process, assuming the breach might happen, while OT invests in prevention. This is why many operators treat control paths into OT as a serious architectural decision. As a result, many organizations oscillate between two extremes. Some expand remote authority into facilities to capture efficiency gains. Others freeze architectures to avoid widening risk. In practice, convergence is a spectrum, and each organization is searching for a disciplined middle ground. Full convergence persists in the conversation for reasons that are not malicious. IT organizational momentum makes deep integration feel inevitable. Executive simplification favors one platform narrative, and market incentives reward integrated platforms. Some sites end up with connected networks but unchanged processes, which can amplify security and operational concerns. Already and before this debate settles, AI arrives as the next variable and raises the stakes. The AI Factor AI changes the threat model because it can operate inside trusted IT environments with legitimate access and produce recommendations that can scale faster than humans can realistically supervise. This matters because many safety discussions implicitly assume that AI remains ‘trapped’ in data centers and cannot twist the knobs or turn the lights on/off in operational infrastructure. Bidirectional IT-OT convergence breaks this structural barrier. AI drives predictive maintenance, analytics, and optimization, which are core motivations for convergence. At the same time, its risk profile is nondeterministic and opaque. AI can influence decisions and automated actions through systems that treat the AI as a trusted participant. AI systems are statistically optimized yet inherently imperfect. AI can pursue unintended objectives, for example, reducing cooling energy by pushing thermal limits in ways that look acceptable on dashboards but erode safety margins. This dynamic is often described as the proxy game, the alignment problem, or Loss of Control. In converged architectures, network paths and automation hooks can turn analytical objectives into operational commands. That shifts the security boundary from networks and devices alone to include the AI model, its inputs, and the governance of what happens after a recommendation is produced. This is why, for forward-looking modernization, a disciplined approach is needed: preserve the safety posture of OT while still enabling AI-assisted insight and optimization. Data centers add a particular twist: the AI optimizing cooling may be running on the same infrastructure that depends on that cooling. That makes boundaries and safety gates a first-order design concern. Early experiments show that AI can recommend constrained actions, but only when paired with explicit safeguards and human oversight. The Federation Architecture Pattern Federation architecture (FA) is a disciplined way to converge IT and OT without expanding the control surface that operators may find hard to justify. It does not reject convergence. It reframes it by making a small set of architectural commitments mandatory and treating any deeper integration as an explicit decision that requires justification. FA is built on three principles: Edge autonomy: Each facility remains capable of safe, deterministic operation even if disconnected from enterprise or cloud systems. Unidirectional data flow: Operational data flows upward for analytics, and architectural write paths into OT systems are removed by design. Human-gated commands: Central systems, including AI, may generate recommendations, but qualified engineers must authorize changes before implementation. FA is intentionally minimal. It is a set of architectural defaults on which other design decisions can safely build. For some organizations, FA may be the convergence model they choose long term. For others, it can be an intermediate stage, a first, safer step through a two-way door to introduce convergence iteratively. After adopting FA, organizations can inspect outcomes and either roll back with low effort or choose controlled deviations from unidirectionality on a case-by-case basis, without weakening edge autonomy or human-gated control. A viable example of relaxing the second principle could be allowing software updates during controlled time windows to specific sections of infrastructure. FA serves as a pragmatic default for organizations seeking cross-domain insight, avoiding permanent remote command authority, and preparing for increased AI integration. FA: What You Keep and What You Trade What you keep with FA Fleetwide visibility and centralized analytics using northbound telemetry Anomaly detection, predictive maintenance, and informed scheduling and planning Digital twin and simulations that support safer change decisions Data-oriented recommendation systems A forward-looking and disciplined strategy that impacts how the whole organization modernizes FA is compatible with how critical infrastructure owners think about risk: keep visibility and decision support and constrain what can directly influence physical systems. From an FA perspective, air-gapped sites might already satisfy two core principles: edge autonomy and human‑gated action. For these sites, adding upward data flow provides analytics value for a reasonable cost. What you trade with FA Speed of remote action and continuous fleet optimization Convenience of always-on bidirectional connectivity Fully automated cross-site and closed-loop response For organizations that have optimized operating expenses through centralization, these trade‑offs reduce key efficiency metrics. For others that are well invested in local assets and personnel, the impact is negligible. FA does not primarily increase technology costs. It reallocates cost from centralized efficiency to local responsibility. Organizations that already operate with site‑level authority experience FA as incremental capex. Organizations optimized for centralized opex reduction experience FA as a structural operating cost increase. FA provides organizations the option to pay in operational capability or in architectural risk. Some organizations may already be deep into bidirectional convergence. They may be able to manage the risks and leverage the closed-loop optimizations. The same is not automatically true for other critical environments where consequences can be physically severe. For those, the guaranteed absence of command paths might even incentivize an FA-style convergence because exfiltration of data no longer equates to a breach of control systems. A Disciplined Approach to Convergence FA captures the analytical upside of IT‑OT convergence and AI while keeping control local and risk explicit, providing a disciplined baseline for modernization in critical environments. By prioritizing edge autonomy, unidirectional data flow, and human-gated commands, FA provides a framework that aligns with the risk-averse nature of critical infrastructure. As AI continues to reshape operational landscapes, adopting a disciplined approach like FA ensures that organizations can modernize without compromising safety or control. Whether as a long-term strategy or an intermediate step, Federation architecture empowers enterprises to navigate the complexities of convergence with confidence.