行业观点：楼宇自控需划定AI数据采信与动作执行的治理边界

Buildings have spent decades learning how to talk.

Sensors measure temperature, humidity, carbon dioxide, pressure, particulate matter, airflow, electrical consumption and equipment state. Building automation systems collect those measurements. Dashboards visualize them. Analytics compare them. Digital twins represent them.

Now artificial intelligence is arriving with the ability to read enormous portions of that building history, recognize patterns, diagnose conditions, recommend changes and, increasingly, initiate actions.

That creates an architectural question I don’t think our industry can avoid much longer.

What evidence should AI be permitted to rely upon — and what should AI be permitted to cause because of it?

Those are two different questions.

And there is a consequence boundary on both sides of intelligence.

THE RECORD IS NOT THE DIAGNOSIS

Let’s start with an air-handling unit.

Imagine we have several years of supply-air temperature, return-air temperature, static pressure, airflow, fan speed, valve position, outdoor-air conditions, electrical consumption and zone environmental measurements.

Those measurements describe things that happened.

They do not automatically tell us why they happened.

This distinction matters:

The record is not the diagnosis.

The diagnosis is not the optimization.

The optimization is not authority.

If we collapse those layers, we create a dangerous feedback loop.

A system observes something, interprets its own observation, changes the building based on that interpretation, and then potentially uses the resulting state as evidence that its original interpretation was correct.

The original record can disappear inside the intelligence acting upon it.

I believe we need to preserve the record first.

ATMOSPHERIC INTEGRITY RECORDS

This is one reason I developed Atmospheric Integrity Records, or AIR.

An AIR is intended to preserve environmental reality independently from the later diagnosis, optimization or intervention.

That means preserving more than a number on a dashboard.

What was observed?

Which sensor or system produced it?

Where?

When?

What equipment or space did it represent?

What happened before and after it?

Did the sensor change?

Did calibration change?

Did the BAS configuration change?

Were there gaps?

Were transformations applied?

What limitations traveled with the record?

The point isn’t to make every measurement magically trustworthy.

It is to preserve enough integrity around the record that we can later examine what that record can legitimately support.

That creates a progression:

REALITY → RECORD → CONTINUITY → ADMISSIBILITY

Now something interesting becomes possible.

THE BUILDING CAN SHOW US DRIFT

Mechanical equipment rarely goes from perfect operation to catastrophic failure in one instant.

It drifts.

A fan requires slightly more power.

A pressure relationship changes.

Airflow begins declining.

A valve operates farther open to achieve the same result.

Temperature recovery becomes slower.

Environmental performance changes gradually.

One measurement may not mean very much.

But an attributable, continuous record spanning months or years can tell a much richer story.

Imagine an AHU that has not generated an alarm.

Occupants aren’t complaining yet.

Nothing has “failed.”

But twelve months of preserved operating history shows that under comparable conditions, fan power has gradually increased while delivered airflow has decreased.

That isn’t automatically a diagnosis.

But it is evidence of change.

Now AI becomes extremely interesting.

An intelligent system can examine that longitudinal record and identify relationships that a technician, operator or engineer might not reasonably find by manually reviewing thousands or millions of individual observations.

AI may be able to identify mechanical or environmental drift long before the condition becomes an emergency.

That’s valuable.

But before we celebrate, there is another question.

WHAT ARE WE GIVING THE AI?

We tend to think of feeding data to AI as if nothing consequential has happened yet.

I don’t think that’s correct.

Giving information to an intelligent system is itself a consequence.

We are allowing a particular computational actor to receive particular information, for a particular purpose, within a particular context.

So before the AI gets the record, I want to ask:

Is this AI permitted to rely upon this evidence for this purpose now?

That means the proposed consequence can be stated explicitly:

Release this bounded environmental and mechanical record to this identified intelligence for this identified purpose.

Now we can govern it.

Is the evidence sufficiently attributable?

Is continuity established?

Is the record current enough for the proposed reliance?

Are material gaps known?

Does the authority exist to release or use it?

Does this system have standing to receive and act computationally upon it?

If those things are not established, the fact that an API connection exists doesn’t answer the question.

Capability is not authority.

The AI should not get information simply because technically we can send it.

NOW LET THE AI THINK

Suppose the record survives that boundary.

The AI receives the governed evidence.

Now let it do what AI can do extraordinarily well.

Compare.

Interpret.

Detect patterns.

Model.

Diagnose.

Predict.

Optimize.

Recommend.

Perhaps it examines eighteen months of AHU history and determines that the relationship between fan power, static pressure and delivered airflow has materially changed.

It proposes:

Increase AHU-1 fan speed from 62% to 66%.

Now we have another boundary.

And the fact that we governed the AI’s input does not authorize its output.

This is where I believe a major architectural mistake could occur in autonomous buildings.

We could assume:

Good data in → intelligent analysis → authorized action out.

That equation doesn’t hold.

An admissible input does not create an admissible output.

ASK THE QUESTION AGAIN

The AI has produced a new proposed consequence.

So TA-14 asks its governing question again:

Does this proposed consequence have sufficient Admissible Evidence, Applicable Authority, and Established Standing to become reality NOW?

Not five minutes ago.

Not when the model was trained.

Not when the building was commissioned.

Not because the AI is usually correct.

NOW.

Maybe everything is established.

ALLOW.

Maybe an important evidentiary condition is unresolved.

HOLD.

Maybe the proposed action is prohibited under the applicable authority.

DENY.

Maybe another authority must make the determination.

ESCALATE.

The important point is that the AI’s recommendation remains a proposition until the consequence earns the right to cross the commit boundary.

WHY CHECK AGAIN?

Because reality does not stop changing while AI thinks.

Suppose the AIR evidence was admitted for analysis at 10:00:00 AM.

The AI completes its analysis at 10:00:20.

At 10:00:25 it proposes changing the AHU.

But at 10:00:22 another material condition changed.

Occupancy changed.

Outdoor particulate levels increased.

A fire mode activated.

An equipment interlock changed state.

Authority expired.

Another operator assumed control.

A maintenance technician entered a hazardous area.

The evidence may have been perfectly appropriate for the AI’s analysis.

That does not establish that the resulting physical action remains appropriate three seconds later.

Every new consequence gets its own NOW.

THEN COMES THE COMMIT LINE

If the proposed consequence receives an ALLOW, it can move toward commit and execution through the appropriate governed system.

That might mean a BAS command.

It might mean a work order.

It might mean notifying an operator.

It might mean scheduling an inspection rather than changing anything automatically.

The appropriate consequence depends on the evidence, authority, standing and governing requirements.

But even after execution, I don’t want the architecture to assume success.

A command is not an outcome.

The BAS saying “command sent” doesn’t prove that the intended physical result occurred.

So we return to where we started.

Reality.

DID IT ACTUALLY WORK?

AIR observes the building again.

What happened after the intervention?

Did airflow increase?

Did pressure stabilize?

Did energy consumption improve or worsen?

Did indoor environmental conditions improve?

Did another condition emerge?

Did the change persist?

Now the building can preserve:

BEFORE INTERVENTION

↓

PROPOSED CONSEQUENCE

↓

AUTHORIZED INTERVENTION

↓

EXECUTION

↓

OBSERVED OUTCOME

↓

NEW BASELINE

That new baseline becomes part of the next Atmospheric Integrity Record.

And the loop begins again.

CONTINUOUS MONITORING IS NOT GOVERNED AIR

I’ve said this many times:

Continuous monitoring is not Governed Air.

I still believe that.

But I think we need to add something important:

The continuous monitoring you already have may become the evidence foundation for Governed Air.

That distinction matters.

TA-14 isn’t arguing that owners need to throw away their sensors, BAS platforms, dashboards, gateways, analytics or AI systems.

Quite the opposite.

Much of the infrastructure may already exist.

The missing architecture may be the governance connecting observation to reliance and reliance to consequence.

Continuous monitoring tells us what the building appears to be doing.

Atmospheric Integrity Records preserve what was actually recorded and the integrity context necessary to evaluate what that record can support.

Intelligence interprets that governed evidence.

Admissible Execution Architecture governs whether the resulting consequence may cross into reality.

And the resulting reality is observed again.

The loop becomes:

REALITY → AIR → GOVERNED RELIANCE → INTELLIGENCE → PROPOSED CONSEQUENCE → AEA → COMMIT → EXECUTION → OUTCOME → NEW REALITY

Then:

NEW REALITY → NEW RECORD

INTEROPERABILITY IS NO LONGER ENOUGH

For decades, the smart-building industry has worked on an enormously important question:

Can these systems exchange information?

Protocols, gateways, semantic models, APIs and connection architectures have helped us answer that question.

But AI introduces another question.

Should this information cross this boundary for this purpose?

And then another:

What may the receiving intelligence cause because it did?

A successful connection does not answer either question.

Neither does authentication.

Neither does a valid command.

Neither does a sophisticated model.

Neither does confidence.

Neither does intelligence.

These systems remain critically important, but the consequence boundary is different.

We have moved from asking whether machines can communicate to asking what happens when their communication can autonomously change reality.

GOVERN BOTH SIDES OF INTELLIGENCE

This is the architecture I believe autonomous buildings will eventually require.

Not because AI is bad.

Because AI is powerful.

We should want AI looking at years of building performance.

We should want it finding mechanical drift before equipment fails.

We should want it finding environmental drift before occupants complain.

We should want it comparing interventions against actual outcomes.

We should want it helping technicians understand complicated systems.

We should want it discovering relationships humans may never find manually.

But intelligence should operate inside boundaries.

On the way into intelligence:

What evidence may this system legitimately rely upon?

On the way out:

What consequence may this system legitimately cause?

And between those two boundaries, keep the layers separate.

Record ≠ Diagnosis

Diagnosis ≠ Optimization

Optimization ≠ Authority

Capability ≠ Authority

Understanding ≠ Permission

An AI can be extraordinarily intelligent and still be wrong.

Governed evidence does not eliminate hallucination.

A sophisticated model does not eliminate uncertainty.

That is exactly why a recommendation should not silently become permission.

FROM SMART BUILDINGS TO GOVERNED BUILDINGS

The smart building was largely about connecting things.

The intelligent building is increasingly about understanding things.

The autonomous building will be about allowing machines to do things.

That last transition changes the architectural question.

Once intelligence can create physical, operational, financial, environmental or human consequence, we need to know what evidence it relied upon, whether that evidence had continuity and admissibility, what authority applied, who or what had standing, what exact consequence was proposed, what crossed the commit boundary and what actually happened afterward.

That is where I believe building automation is heading.

Not away from AI.

Toward AI that can participate in a governed chain from reality back to reality.

Govern what intelligence may rely upon.

Govern what intelligence may cause.

Preserve what actually happened.

Then return to reality and do it again.

Because ultimately, the most important question in an autonomous building isn’t whether the machine is intelligent enough to act.

It is: