Tier-gated Control Authority

The hardest question in AI-augmented building control is not can the model find a better setpoint? — it usually can. The hard question is who is responsible if the new setpoint floods the lobby on a Saturday at 2am? AiTBMS answers this with a four-tier writeback authority model that makes the responsibility chain explicit for every single proposed control action, and gives the building owner, not the vendor, the dial that decides how much autonomy each agent gets.

The four tiers

Every control action proposed by an AiTBMS agent is born into one of four authority tiers. The tier determines what happens between "the model proposed it" and "the BMS executed it." Operators can re-tier an agent at any time; new agents start at the most conservative tier and graduate up only after a clean track record.

Tier 1 — Advisory

The agent never writes to the BMS. It surfaces a recommendation in the action queue with full justification, expected impact, and supporting trend data, and a human operator decides whether to apply the change manually using the BMS's native interface. This is the default for any agent's first 30 days, for any change that affects life-safety adjacent equipment (smoke control, stairwell pressurization, generator parallel switching), and for any change where the expected energy impact is below the noise floor of the building's metering.

Example: The Occupancy-Aware Scheduler notices that lighting on Floor 7 stays on until 20:00 even though the badge data shows the floor is empty by 18:30 on Tuesdays and Thursdays. It proposes trimming the schedule to 19:00, surfaces the recommendation as advisory, and waits for the operator to make the change in the BMS schedule editor. AiTBMS records that the recommendation was made and whether the operator accepted it.

Tier 2 — Human-approve

The agent writes the proposed value into a queued action, but the write is staged, not executed. An operator must explicitly approve it from the action queue. Once approved, AiTBMS issues the write through the adapter's normal writeback path, captures the BMS's response, and monitors the affected points for a configurable observation window (default 60 minutes) for any unexpected behavior.

Example: The G36 Conformance Auditor detects that AHU-3's economizer high-limit setpoint is 70°F — five degrees above the ASHRAE Guideline 36 reference of 65°F. It queues control action A-2026-411 to reset the high-limit to 65°F, expected impact 124 kWh/day, with the full G36 citation and a link to the trend history showing economizer mis-cycling. The chief engineer reviews it Monday morning and approves. AiTBMS writes the new setpoint, watches the next four economizer transitions, and flags any anomaly back into the queue.

Tier 3 — Supervised-auto

The agent writes without per-action approval but only within a pre-approved envelope: a documented set of points, a documented value range, a documented schedule window, and a documented expected-impact ceiling. Every write still appears in the audit log and the action queue, but as a notification, not a request. If a write falls outside the envelope, it auto-downgrades to Tier 2 and waits for human approval.

Example: After 30 days of clean Tier 2 history on chiller pre-cool windows, the operations team graduates the Marginal Emissions Optimizer to supervised-auto for one specific action: shifting the pre-cool start time within a ±2-hour window around 13:00 based on grid carbon forecast. The agent now adjusts the start time daily without asking, but if the optimal forecast asks for a window outside ±2 hours, the action drops back to Tier 2.

Tier 4 — Full-auto

The agent writes freely within its agent-specific scope, with no per-action notification. Every write is still logged and retrievable, but the operator only sees aggregated daily summaries unless an exception threshold is tripped. This tier is reserved for narrow, well-bounded actions on equipment with no life-safety impact and a long clean track record. In practice, very few agents earn this tier; lighting schedules and non-critical zone setpoint trims are the typical candidates.

Example: The Occupancy-Aware Scheduler, after 90 days of clean Tier 3 lighting schedule adjustments, is graduated to full-auto for floors 7–9 lighting only — chiller and AHU schedules remain at Tier 2 indefinitely. Daily summary email lists the day's adjustments and net kWh impact.

Why this matters

The tier model exists because trust is something that gets earned per-action, per-equipment, per-building — not granted globally to "the AI." A vendor that ships full-auto control on day one is asking the building owner to take the operational risk for the vendor's marketing claims. A vendor that ships advisory-only forever is providing a fancy alarm console, not a control system. The four-tier model lets you start conservative and graduate confidence incrementally, with full audit trail and instant downgrade if anything looks wrong. Every proposed and executed action remains queryable for the life of the deployment, with the originating agent, the justification, the observation-window result, and the operator who approved it (if any) all on the record.