One shared control room for operators, software agents, and robots—with live redirection, safety boundaries, and one operational record.Warehouses, ports, and distribution networks run software planners that command physical robots — and the operational telemetry, layouts, and customer shipment data they generate are competitive and contractual data that stays inside the facility, not on a vendor's cloud. The stitched alternative — software agents on a cloud platform, robots on vendor middleware with its own identity and logging — has no single answer to who did what across the boundary, and no one team keeping it all patched. Visca runs software and embodied actors on one stack — one identity model, one credential model, one runtime, one record — inside the facility, with its own operators maintaining it.
Shared AI work is useful only when authority, data, and consequences remain controlled.
01
Two disjoint stacks
Software agents run on one stack; robots run on robotics middleware with its own identity, logging, and deployment. There's no shared answer to who did what across the boundary.
02
Robots with no verifiable identity
A robot is a serial number plus whatever firmware-signing the vendor ships. A receiving system can't cryptographically verify that a command came from a specific physical machine in a specific configuration.
03
Safety envelopes hand-rolled per vendor
Geofences, force limits, and allowed-operation constraints are coded differently for every robot vendor — inconsistent, hard to audit, easy to drift.
One shared workspace, not scattered agent threads
The collaboration and control plane around every participant, model, tool, and action.
01Identity
Verifiable machine identity
Each robot carries an attested identity bound at boot. A receiving system can verify which physical machine, in which configuration, issued a command — and which planner authorized it.
02Credentials
Scoped authority to move things
A move command executes on a scoped, time-bound credential — this robot, this operation, this window — not a standing connection from the planner to the fleet.
03Runtime
One runtime, with safety envelopes
Software planners and embodied actors run on the same runtime, with behavioral safety envelopes — geofences, force limits, allowed operations — enforced uniformly across robot vendors.
04Audit
One record across the boundary
Every planner decision, every actuation, every operator intervention lands in one chained record — replayable as a single timeline across software and hardware.
05Operators
Maintained on-site, on the record
The stack's own operators deploy, upgrade, patch, rotate credentials, and answer incidents inside the facility — under the same identity and audit as the fleet they maintain.
What the institution gets
Durable control without giving up capability.
Operate software and embodied actors as one fleet, on one record
Cryptographically verify which physical machine did what
Enforce safety envelopes uniformly across robot vendors
Resident operators maintain the stack on-site — recorded
In practice
A mispick investigation
A pallet is mis-routed. The investigation is a single query: the planner's decision, the credential that authorized the move command, the specific robot's attested identity, the actuation telemetry, and the operator override — one timeline, replayable. And when the fix is a patched planner, the patch ships through the resident operators and lands on the same record the investigation cites.
Relevant control frameworks
SOC 2 Type IIISO 27001Functional-safety alignment (ISO 10218 / R15.06)
