Platform

Perception at the line. Reasoning above it. Guardrails around both.

The Milkeon platform is a plant-edge inference runtime, a plant orchestrator with a policy engine, the Lactwin twin, and a cloud or on-prem training loop. Agents perceive from cameras, analyzers, lab data and PLCs, predict composition, contamination, moisture and takt, and act through guarded connectors.

Book a plant review Meet the agents

Plant edge + cloud or on-premNine agents, one orchestratorAudit log from day one

run_scn_01 · agent graph · scenario 10 nodes · 1 approval gate
01 · orchestrator intake.receive ✓ SUCCEEDED 02 · orchestrator twin.simulate ✓ SUCCEEDED 03 · intake_separate separate.standardize ✓ SUCCEEDED 04 · pasteurize_homog pasteurize.verify ✓ SUCCEEDED 05 · ferment_culture culture.vat ✓ SUCCEEDED 06 · evaporate_dry dry.spray ✓ SUCCEEDED 07 · defect_inspect inspect.pack ✓ SUCCEEDED 08 · hygiene_cip cip.schedule ✓ SUCCEEDED 09 · orchestrator approve.human ◆ APPROVAL 10 · quality_conf release.genealogy ✓ SUCCEEDED

Illustrative scenario: Plant run · skim-milk-powder line + set-yogurt line · shared intake. Not a measured run.

Architecture

The loop, end to end

Perceive the milk, the stream and the product; plan intake, separation, pasteurization, culture, drying and inspection; run with adaptive setpoint and recipe control; sense and predict composition, contamination and safety risk; optimize yield, loss, energy, water and takt; flag off-spec; log; retrain.

01 · Sense

Plant-edge ingestion

PLC and SCADA, MES, lab systems, inline analyzers, cameras, spectral sensors, robots, CIP skids and energy and water meters are normalized into one plant state at the edge.

02 · Infer

Edge models

Fine-tuned vision, spectral composition, separation, pasteurization, culture and drying models, plus time-series prognostics for separators, pasteurizers and dryers, served with TensorRT and Triton.

03 · Reason

Plant orchestrator

Retrieves recipes, HACCP and CIP procedures with citations, asks the agents for recommendations, runs constraint checks, rehearses high-impact moves on Lactwin and applies the autonomy policy.

04 · Act and learn

Guarded write-back

Approved actions go back through OT connectors inside tag, rate and magnitude limits. Every action and every technologist correction becomes a labeled event for the training loop.

Run timeline

A run is the unit of work

Every Milkeon run is an ordered, inspectable sequence. This is run_scn_01, an illustrative scenario: Plant run · skim-milk-powder line + set-yogurt line · shared intake. Scenario complete · both streams inside spec · one human approval at the dryer.

run_scn_01 scenario · not measured SUCCEEDED
  1. 01 intake.receive SUCCEEDED 0.9 s

    Plant Orchestrator · Pulled both product specs, the HACCP plan with its pasteurization critical control point, the antibiotic screen for the tanker lot and the standing CIP window from MES and the lab system; locked the target envelope for the run.

  2. 02 twin.simulate SUCCEEDED 41 s

    Plant Orchestrator · Simulated 24 candidate recipes across separation, pasteurization, evaporation and spray-drying on the Lactwin as-processed twin; ranked them on composition margin, pasteurization margin, energy per kilogram of powder and takt, and discarded every candidate that thinned the pasteurization margin.

  3. 03 separate.standardize SUCCEEDED 3 m 05 s

    Intake-and-Separate · Fused inline NIR and mid-IR with the latest lab calibration, then trimmed the cream-skim split and the standardization blend valve so skim solids and the yogurt-stream fat sat at target with the minimum safe margin rather than the usual over-standardization.

  4. 04 pasteurize.verify SUCCEEDED continuous

    Pasteurize-and-Homogenize · Held HTST at or above 72 °C for 15 s through the holding tube with the flow-diversion valve armed; every critical control point reading was written to the audit log against the HACCP plan.

  5. 05 culture.vat SUCCEEDED 4 h 20 m

    Ferment-and-Culture · Predicted the acidification curve for the culture lot from inline pH and the upstream composition, held the vat temperature profile and timed the hold so pH landed on the set-yogurt target curve; no abnormal acidification was flagged.

  6. 06 dry.spray SUCCEEDED 2 h 10 m

    Evaporate-and-Dry · Ran the dryer against the twin's moisture and stickiness prediction; stepped inlet temperature and feed solids toward the minimum-energy setpoint while predicted outlet moisture stayed inside spec and fouling risk stayed low.

  7. 07 inspect.pack SUCCEEDED continuous

    Defect-and-Inspect · 16 camera streams across the two packing lines at the plant edge: fill, seal, cap and label checks on every unit, foreign-body and contamination models on the powder stream; two rejects were attributed back to a seal-jaw temperature drift and the packing line was notified.

  8. 08 cip.schedule SUCCEEDED 6 s

    Hygiene-and-CIP · Placed the pasteurizer and dryer CIP into the cheapest energy window, sequenced wash phases against tank availability and set the release checks that must pass before the next product.

  9. 09 approve.human APPROVAL 1 m 48 s

    Plant Orchestrator · The twin's lowest-energy candidate wanted a dryer inlet temperature above the site's bounded envelope. Held for the shift dairy technologist, who approved the step with a tighter outlet-moisture alarm.

  10. 10 release.genealogy SUCCEEDED 1 m 12 s

    Quality-and-Conformance · Both batches released: composition, CCP records, culture lot and pH curve, drying setpoints, inspection rejects and every human decision written to the batch genealogy and checked against spec.

Tool calls

The agent shows its work

Every tool invocation, argument and result is written to an immutable, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant. The log below is the scenario run, not a measured one.

tool-call stream · run_scn_01
  1. 05:10:02mes.read_order({ lot: "T-0417", products: ["SMP", "SET-YOG"] })
  2. 05:10:02ok specs locked · HACCP plan v7 · CCP: pasteurization 72 °C / 15 s
  3. 05:10:03lab.read_results({ lot: "T-0417", test: "antibiotic_screen" })
  4. 05:10:03ok negative · lot accepted for intake
  5. 05:10:04twin.simulate({ candidates: 24, horizon: "shift" })
  6. 05:10:45ok best recipe #9 · pasteurization margin held · lowest energy per kg
  7. 05:10:46policy.evaluate({ recipe: 9, stage: "bounded" })
  8. 05:10:46ok 7 writes permitted · 1 write requires human approval
  9. 05:10:47plc.write_setpoint({ tag: "SEP1.BLEND_VALVE", basis: "nir+midir+lab" })
  10. 05:13:52ok skim solids on target · yogurt-stream fat at minimum safe margin
  11. 05:13:53plc.verify_ccp({ tag: "PAST1.HOLD_TUBE", min: "72 °C / 15 s" })
  12. 05:13:53ok CCP verified · divert valve armed · readings → audit log
  13. 05:14:10dose.culture({ vat: "Y2", lot: "C-2291", profile: "set-yogurt" })
  14. 05:14:10ok acidification curve predicted · hold timed to target pH
  15. 05:14:12approval.request({ action: "dryer.inlet", reason: "above bounded envelope" })
  16. 05:16:00ok approved by the shift dairy technologist · tighter moisture alarm set
  17. 05:16:01plc.write_setpoint({ tag: "DRY1.INLET_T", mode: "min_energy" })
  18. 05:16:01ok predicted outlet moisture inside spec · fouling risk low
  19. 05:16:02vision.stream({ cameras: 16, models: ["fill_seal", "foreign_body"] })
  20. 05:41:18reject: seal fault · unit 1184 · attributed to seal-jaw temperature drift
  21. 05:41:19defect.attribute({ event: "seal_fault", cause: "pack_line.jaw_temp" })
  22. 05:41:19ok packing line notified · second reject at 05:43:02 · drift corrected
  23. 05:41:20cuopt.schedule({ assets: ["PAST1", "DRY1"], window: "energy_low" })
  24. 05:41:20ok CIP sequenced · release checks armed
  25. 09:36:40mes.release_batch({ batches: ["SMP-0417", "YOG-0417"], genealogy: "full" })
  26. 09:37:52ok both batches released · scenario complete

Reasoning trace

Goal, plan, thought, action, observation, exactly as the orchestrator would record it.

GoalReceive tanker lot T-0417, standardize it once, pasteurize onc…

Receive tanker lot T-0417, standardize it once, pasteurize once, and run a skim-milk-powder stream and a set-yogurt stream to spec with full genealogy.

PlanSimulate the whole recipe on the twin first. Lead with composi…

Simulate the whole recipe on the twin first. Lead with composition so the dryer gets the right solids and the vat gets the right fat. Verify the pasteurization critical control point continuously. Let the dryer chase minimum energy only inside the bounded envelope; hold anything beyond it for a human.

ThoughtThe standing recipe over-standardizes both streams to protect …

The standing recipe over-standardizes both streams to protect against lab-sample lag. With continuous NIR and mid-IR estimates the blend can sit at the minimum safe margin. The saving is composition give-away, not safety margin: the pasteurization CCP is never a candidate for optimization.

Actiontwin.simulate(candidates=24) → recipe #9: minimum safe composi…

twin.simulate(candidates=24) → recipe #9: minimum safe composition margin, pasteurization margin unchanged, lowest predicted energy per kilogram of powder.

ObservationRecipe #9's dryer inlet temperature sits above the site's boun…

Recipe #9's dryer inlet temperature sits above the site's bounded envelope. The policy engine routes that single write to the shift dairy technologist and permits the other seven.

ActionExecute recipe #9 at the bounded stage: separation and standar…

Execute recipe #9 at the bounded stage: separation and standardization writes, CCP verification, culture dosing and the vat profile proceed; the dryer inlet write waits.

ObservationApproval granted at 05:16:00 with a tighter outlet-moisture al…

Approval granted at 05:16:00 with a tighter outlet-moisture alarm. Two seal rejects on the yogurt packing line were attributed to seal-jaw temperature drift and corrected by the packing line.

OutcomeScenario complete. Both batches released with composition, CCP…

Scenario complete. Both batches released with composition, CCP records, culture lot, drying setpoints, inspection events and the human decision in the genealogy. No measured plant result is claimed; this is the run the platform is designed to execute.

Plant edge

The edge node is the product

Milk is perishable and the lines never stop, so Milkeon's inference runs beside the equipment and keeps working if the cloud does not.

  • Local inference. Reject and alert decisions in 50 to 150 ms and composition estimates in 250 to 1,000 ms, as design targets, on Jetson Orin or Thor and plant-edge GPU servers.
  • Deterministic stream fusion. DeepStream and Holoscan fuse 8 to 24 camera and analyzer streams per line.
  • Model routing. Triton and NIM serve 10 to 40 concurrent models per plant, routed by product, line and sensor package.
  • Fails to existing control. If the node, the network or a model stops, the plant keeps running on its PLC and SCADA control and interlocks.
  • Tenant-scoped memory. Per-plant yield-and-quality history and per-technologist corrections stay with the plant.

What runs where

WorkloadWhere
Vision, spectral and control inferencePlant edge
Orchestrator, policy engine, audit logPlant edge
Training and fine-tuningCloud, private cloud or on-prem GPUs (planned)
Lactwin CFD and process twinGPU cloud or on-prem (planned)
Synthetic rare-fault generationGPU cloud (planned)
Fleet analytics, model governanceCloud or private cloud
Digital twin

As-processed, not as-designed

Lactwin couples GPU-accelerated CFD and process and biology simulation of separation, heat exchange, fermentation, evaporation and spray-drying with the live plant state, so a recipe is rehearsed before milk and energy are spent.

Before the run

Recipe and envelope search

Candidate recipes are ranked on composition margin, pasteurization margin, energy per kilogram and takt. Anything that thins a safety margin is discarded before it is ever proposed.

During the run

Setpoints for the agents

Optimized setpoints are handed to Sepion, Culvex and Aridyn. Distilled surrogates run at the edge for on-line envelope checks.

After the run

Reconciliation

Twin-versus-actual drift is measured on every batch and feeds the next calibration. Validated synthetic rare faults harden every model.

Lactwin in detail

Accelerated computing

Physical AI, at the plant edge

Milk is perishable and the lines are continuous, so perception has to be local and fast. Milkeon runs GPU inference at the plant edge and keeps training, simulation and optimization in the cloud, in a private cloud or on-prem. Items marked planned are on the roadmap, not running.

Jetson Orin / Thor · DeepStream · Holoscan · TensorRT

Edge perception

8 to 24 camera and inline-analyzer streams per line. Design target: 50 to 150 ms reject and alert decisions, 250 to 1,000 ms composition estimates, all at the plant edge.

Triton · NIM

Model serving

Defect, composition, shelf-life, process-state and dairy-reasoning models behind one orchestrator, with version routing by product, line and sensor package. Design target: 10 to 40 concurrent models per plant.

DGX / HGX · NeMo

Training (planned)

Vision, spectral, time-series and dairy-reasoning models fine-tuned from labeled batch outcomes, operator corrections, lab results and validated deviations. Initial design target: 2k to 10k GPU-hours.

Omniverse · Modulus · OVX

Digital twin (planned)

GPU-accelerated CFD and process simulation of separation, heat exchange, fermentation, evaporation and spray-drying, run as-processed before the batch to find safe, low-energy recipes.

Cosmos · Omniverse Replicator

Synthetic data (planned)

Rare contamination, foreign-body, fouling, seal, fill and drying-upset scenarios generated with domain randomization and always validated against real plant events before use.

cuOpt

Optimization

Product sequencing, tank allocation, dryer scheduling, CIP timing, energy and water constraints and line balancing, recomputed on the GPU when the plant is disrupted.

Isaac · Jetson

Robotic handling

Packaging, palletizing and material handling for product, packs and pallets, with perception and motion policies built in simulation before they touch the packing hall.

Autonomy

Four stages, set per loop

A plant does not go from manual to bounded control in one step. Milkeon makes the stage explicit per loop, auditable and reversible at any time, and some decisions never leave the person.

Autonomy stages and the human role at each
StageWhat the agent doesWhat the person doesWhen
ShadowPredicts composition, contamination, moisture and takt; writes nothingRuns the plant as today; compares predictions to lab resultsFirst phase with every design partner
AssistRecommends separation, pasteurization, culture and drying moves with the evidenceA dairy technologist or process engineer approves or corrects each oneAfter accuracy is proven against the baseline
BoundedWrites low-risk separation, drying and inspection setpoints inside explicit limitsApproves anything above the limits; reviews the shift recordAfter the food-safety and ROI gates agreed up front
ExceptionsEscalates anything outside its envelope, CCP-adjacent moves and release decisionsAlways decides these; the agent never doesPermanent
Multi-agent handoff

Agents negotiate, they do not collide

Two agents will want the same actuator. The orchestrator arbitrates on the run goal, with food safety above everything, and the handoff is logged like any other step.

Contested move: pasteurizer flow rate

  1. 01yield_takt.request(flow +6%) SUCCEEDED0.2 s

    Yield-and-Takt wants more flow through the pasteurizer so the powder stream starts earlier and the dryer is not left waiting.

  2. 02pasteurize_homog.request(flow hold) SUCCEEDED0.2 s

    Pasteurize-and-Homogenize requires the flow that keeps holding time at or above 15 s at 72 °C. That is the HACCP critical control point.

  3. 03orchestrator.arbitrate SUCCEEDED0.4 s

    Food safety outranks takt under every run goal. The critical control point wins the actuator; the request for more flow is logged with its score and the reason it lost.

  4. 04yield_takt.handoff(resequenced) SUCCEEDED90 s

    Yield-and-Takt recovers the schedule by starting the evaporator on the first standardized skim instead of waiting for the full tank. Takt is met without touching the CCP.

Arbitration rules

  • Run goal first. Every request is scored against the declared goal, not against the requesting agent's local objective.
  • Food safety outranks everything. A critical control point is never an optimization variable. A pasteurization or seal escape is a recall; a takt miss is a schedule.
  • Time-boxed ownership. An agent holds a contested actuator for a bounded window, then must re-justify.
  • Everything is logged. The losing request, the score and the reason all appear in the run record.
  • Deadlocks escalate to a human rather than resolving by timeout.

See the agent roster

Agent roster

Nine agents and an orchestrator

Each agent owns a stage of the plant, a bounded tool set and a measured outcome. They negotiate for shared actuators through the orchestrator, never directly. Five ship as products; the rest arrive with the Plant tier.

agent.intake_separate

Intake-and-Separate

Milk intake, clarification, separation, standardization

Fuses inline NIR and mid-IR analyzers, separator telemetry and lab results into a continuous fat, protein and solids estimate, then holds the cream-skim split and the standardization blend at target with the minimum safe margin instead of defensive over-standardization.

nir.read_compositionplc.read_separatorplc.write_setpoint(blend_valve)

Design scope: give-away toward zero, every batch inside spec

Ships in: Sepion

agent.pasteurize_homog

Pasteurize-and-Homogenize

HTST and UHT time-temperature, homogenization

Holds pasteurization time-temperature and homogenization pressure for safety and shelf life without over-processing, writes every critical control point reading to the audit log and never touches the flow-diversion interlock.

plc.verify_ccp(holding_tube)plc.read_homogenizeraudit.write

Design scope: CCP margin held, over-processing avoided

Ships in: Plant tier

agent.ferment_culture

Ferment-and-Culture

Fermentation, culture activity, pH and texture

Predicts the acidification and texture trajectory per product and culture lot from inline pH, temperature and the upstream composition, then holds the temperature profile, culture dosing and cut and cook windows so pH and texture land on target.

ph.read_vatdose.cultureplc.vat_profile

Design scope: consistent set and flavor, early phage alerts

Ships in: Culvex

agent.evaporate_dry

Evaporate-and-Dry

Evaporation, spray-drying, moisture, solubility, fouling

Fuses inline moisture, temperature, humidity, feed solids and pressure with a GPU process twin of the evaporator and dryer to predict outlet moisture, solubility, particle size and fouling risk, and runs the dryer at the minimum energy that still holds powder spec.

nir.read_moisturetwin.predict_foulingplc.write_setpoint(dryer.inlet)

Design scope: powder spec at minimum energy and water

Ships in: Aridyn

agent.defect_inspect

Defect-and-Inspect

Contamination, foreign-body, fill, seal, cap and label faults

Runs multi-camera vision and inline sensing at the plant edge to detect and predict contamination, foreign bodies, fill, seal, cap and label faults at line speed, rejects off-spec units and attributes each defect back to the upstream agent that caused it.

vision.stream(cams)reject.actuatedefect.attribute

Design target: 50 to 150 ms reject and alert decisions

Ships in: Vizra

agent.quality_shelflife

Quality-and-Shelflife

Fat, protein, moisture, texture and shelf-life optimization

Predicts shelf life and finished-product quality from composition, pasteurization margin, culture outcome and drying state, and proposes the recipe moves that protect both before product is released.

shelf.predictspec.checkrecipe.propose

Design scope: quality and shelf life predicted before release

Ships in: Plant tier

agent.yield_takt

Yield-and-Takt

Yield, loss, energy, water and line balancing

Prices every candidate move in liters, kilograms, kilowatt-hours and cubic meters of water, sequences products and tanks, and balances the line so takt is met without starving the dryer or the packing hall.

cuopt.sequenceenergy.budgetwater.budget

Design scope: yield up, loss, energy and water down

Ships in: Plant tier

agent.hygiene_cip

Hygiene-and-CIP

CIP, hygiene and food-safety assurance

Schedules clean-in-place around production and energy windows, tunes wash duration, chemical concentration and water reuse within the validated program, and holds the release checks that must pass before the next product runs.

cip.schedulecip.verify_releasecuopt.schedule(cip_window)

Design scope: CIP release checks enforced, water reused

Ships in: Plant tier

agent.quality_conf

Quality-and-Conformance

Right-first-time, non-conformance, batch genealogy, traceability

Builds the batch genealogy record, composition, CCP readings, culture lot, drying setpoints, inspection events and every human decision, and gates release against product spec and the plant's food-safety procedures.

mes.release_batchgenealogy.writeaudit.write

Design scope: complete, immutable release records

Ships in: Plant tier

agent.orchestrator · coordinates all nine

Plant Orchestrator

Planning, arbitration, human approval, twin rehearsal

Plans the run, rehearses high-impact moves on the Lactwin twin, arbitrates between agents that want the same actuator, enforces the autonomy stage per loop and routes anything above the site threshold to a named human. Grounds its reasoning in the plant's recipes, HACCP plan and CIP procedures through cited retrieval.

plan.composepolicy.evaluateapproval.requesttwin.simulate

Design rule: every write policy-checked, every output cited

Ships in: Every tier

Design targets

What the platform is engineered against

The numbers Milkeon is engineered against, from the GPU utilization plan.

50–150 ms p95 latency for reject and alert decisions at the plant edge
250–1,000 ms p95 latency for inline composition estimates
8–24 camera and inline-analyzer streams per line
10–40 concurrent models served per plant, routed by product, line and sensors
2k–10k GPU-hours of training across the first design-partner cohort
50k–250k synthetic rare-fault scenarios, each validated against real plant data

Design targets from the GPU utilization plan. Nothing on this page is a measured plant result; measurements start when the first design-partner line runs in shadow mode.

Developers

Every action is a record

There is no SDK to download yet. What design partners get is the integration surface: connectors, an autonomy policy declared per loop, and an audit record for every reading, recommendation, write and approval. This is the shape of one record, illustrative.

What the surface gives you

  • Connectors to PLC and SCADA, inline analyzers, lab systems, MES, cameras and meters, with declared allow-lists and limits
  • An autonomy policy per loop: stage, tags, rate and magnitude limits, named approvers
  • Citations on every recommendation to the recipe, spec or procedure it relied on
  • Model versions named in every record, with rollback by version
  • Export of the audit log and batch genealogy to your quality system

What the docs cover Developer overview

audit record · illustrative 
// one write, as the audit log would hold it
{
  "run": "run_scn_01",
  "step": "separate.standardize",
  "agent": "agent.intake_separate",
  "stage": "bounded",
  "action": { "tool": "plc.write_setpoint", "tag": "SEP1.BLEND_VALVE" },
  "limits": { "max_step": "declared per tag", "per": "declared per tag" },
  "evidence": ["nir.read_composition", "lab.read_results"],
  "citation": "spec:SMP-standardization v4 §2",
  "policy": "permitted",
  "models": { "composition": "versioned", "policy": "versioned" },
  "human": null,
  "outcome": "inside spec · minimum safe margin"
}
From the plant floor

Who this is built for

The three people in a dairy plant whose week changes when the process runs itself, and what each of them needs from Milkeon.

Economic buyer

Plant or Operations Director

Owns production rate, quality, loss and yield, energy and water, and food safety. Wants a plant that holds spec at higher rate with fewer interventions, and a number that justifies the spend.

Champion

Dairy Technologist or Process Engineer

Owns separation and standardization, pasteurization, culture and drying recipes, process windows and yield. Approves and corrects the agents in assist mode; those corrections train the models.

Approver

Quality and Food-Safety Manager

Owns HACCP, FSMA, ISO 22000 and FSSC conformance, composition and contamination conformance, and batch genealogy. Needs every action grounded, cited and written to an immutable record.

IT/OT and sustainability leads approve the deployment. There are no customer quotes on this site yet; design partners will speak for themselves when they choose to.

Integrations

It speaks plant, not cloud

Milkeon reads and writes through the systems already on the floor. No parallel historian, no new HMI, no rip-and-replace. Connectors are built against each design partner's stack first; long-tail integrations are out of scope for the first release.

Plant automation

PLC and SCADA of separators, pasteurizers, homogenizers, culture vats, evaporators, spray dryers and CIP skids

Setpoint reads, guarded writes, interlocks untouched

Inline analyzers

NIR and mid-IR composition, inline pH, moisture, temperature and humidity

Continuous composition and process state

Lab systems

LIMS results, calibrations, antibiotic and micro screens

Calibration and release evidence

Dairy MES

Orders, recipes, product specs, batch genealogy

Targets in, release records out

Vision

Multi-camera stations on filling, sealing, capping, labeling and powder lines

Frames, defect events, reject commands

Energy and water

Plant and asset-level meters

Hard constraints for the dryer and CIP schedule

Robotics

Isaac-driven packaging, palletizing and handling cells

Perception and motion for packs and pallets

Identity (planned)

SSO and role-based access; SOC 2 on the roadmap

Named approvers, scoped roles

See all integrations

Guardrails

An agent that can move a setpoint needs a leash

Milkeon writes to production equipment in a food plant. Every capability is scoped, every write is policy-checked, every output is cited, and every action is written to an append-only audit log the plant owns.

  • Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate and magnitude limits, at the autonomy stage the plant has set.
  • Critical control points are read, never written. Pasteurization time-temperature, flow diversion and release decisions stay with the HACCP plan and the people who own it.
  • Policy engine before every write. Autonomy stage, interlock state, product, shift and operator presence are evaluated before a setpoint moves.
  • Grounded and cited. Every recommendation carries a citation to the recipe, spec or procedure it relied on. Retrieval is tenant-isolated and permission-aware.
  • Immutable audit log. Append-only, exportable and retained on the plant's own storage, aligned to HACCP, FSMA, ISO 22000 and FSSC record-keeping.
  • Hard fallback. If the edge node, the network or a model stops, the plant keeps running on its existing PLC and SCADA control and interlocks.
  • Tenant and IP isolation. Recipes, supplier data and tolerance models never cross a customer boundary. On-prem deployment available.

Assurance posture

ItemScopeStatus
SOC 2 Type ICloud control plane QUEUED Roadmap, first 6 months
SOC 2 Type IICloud control plane QUEUED Roadmap, 6 to 12 months
HACCP · FSMA · ISO 22000 · FSSC · CodexGrounding and record-keeping RUNNING Design basis for retrieval and the audit log
Per-tenant isolationData, memory, models RUNNING Design rule
On-prem deploymentRecipe-sensitive producers RUNNING Design option

Milkeon supports your food-safety records. It is not a certification and it does not replace your HACCP plan.

Read the security overview

Enterprise

Standardize autonomy across the group

One policy model, one audit trail and one set of yield, loss, energy and water benchmarks across every plant in the group, with each site's recipes and tolerance models kept private to that site.

Talk to us Enterprise details

  • Multi-site plant-edge fleet with shared model governance
  • Custom product, composition and tolerance models per site
  • SSO and role-based access, named approvers (roadmap, 6 to 12 months)
  • Model versioning, validation reports and rollback
  • On-prem or private-cloud deployment
  • SLAs and outcome-based components on the highest-value workflows
FAQ

Straight answers

The questions plant directors, technologists and quality managers ask in the first meeting.

Only at the autonomy stage your plant has set, and only to an explicit allow-list of low-risk loops inside explicit limits. Every design partner starts in shadow mode, where Milkeon predicts and writes nothing. Assist mode follows, where a technologist approves each recommendation. Bounded autonomy on separation, drying and inspection loops comes after the food-safety and ROI gates agreed up front.

Get started

See the platform on your line

One line, one baseline, shadow mode first. We will show you the run record before anything is written.

Book a plant review See pricing