转载 Sakara Digital 博客：AI 智能体可起草偏差但不能放行，提出 GMP 质量运营四级监督框架

Agentic AI in Quality Operations: Where Autonomy Stops

质量运营中的智能体式 AI：自主止于何处

一套四级监督框架与四问测试，界定哪些质量任务可以交给智能体、哪些必须留给有资质的人

题图：洁净车间内的操作人员。，来源 Sakara Digital 官方博客，2026 年 10 月 13 日。

本文目录 ｜ In This Article

一. 摘要

二. 智能体式 AI 给质量组织带来什么变化

三. 法规已经对“谁来决定”说了什么

四. 质量运营中自主权的决策框架

五. 哪些地方可以接受自主

六. 哪些地方不能接受自主

七. 灰色地带：分诊、分类与关闭建议

八. 把边界做进系统，而不是做进提示词

九. 一个务实的起步顺序

十. 结论

十一. 延伸阅读

十二. 参考文献与来源

一、摘要

Executive Summary

Agentic AI in quality operations is no longer a thought experiment. Agents that plan their own steps, call tools, and write into business systems are being demonstrated on root cause analysis, investigations, and CAPA work. The question for quality leaders is not whether these tools can act. It is which quality actions an agent should be allowed to take on its own, and which must stay with a named, qualified person.

智能体式 AI 进入质量运营，已经不是思想实验。能够自己规划步骤、调用工具、并往业务系统里写入内容的智能体，已经在根因分析、调查和 CAPA 工作上有了演示。对质量负责人来说，问题不再是这些工具能不能动手，而是哪些质量动作可以允许智能体自己去做，哪些必须留给一个具名的、有资质的人。

The answer is already written into the regulations most pharma and biotech companies work under. The quality control unit approves or rejects product. A Qualified Person certifies each batch in the EU. An electronic signature belongs to one individual. The EU’s draft Annex 22 says generative AI and large language models should not be used in critical GMP applications at all. From those fixed points, this article builds a four-level oversight framework and a four-question test that sorts any quality task into the right level.

答案已经写在大多数制药和生物技术公司都要遵守的法规里。质量控制部门批准或拒绝产品。在欧盟，每一个批次由合格人（QP）认证。电子签名只属于某一个个人。欧盟的 Annex 22 草案直接写明，生成式 AI 和大语言模型根本不应该用于关键 GMP 应用。从这几个固定点出发，本文搭出一套四级监督框架和一个四问测试，把任何质量任务分到正确的级别上。

We cover what “agentic” changes, what the rules say about who decides, the framework itself, the tasks where autonomy is acceptable (data gathering, drafting, monitoring), the tasks where it is not (release, final disposition, GxP record approval, reportability), the gray zone of triage and classification, and how to build the boundaries into system permissions rather than into the agent’s instructions.

本文覆盖这些内容：智能体式带来了什么变化；法规对“谁来决定”已经说了什么；框架本身；哪些任务可以接受自主（数据收集、起草、监测）；哪些不可以（放行、最终处置、GxP 记录批准、可报告性判定）；分诊与分类这块灰色地带；以及如何把边界做进系统权限，而不是写进智能体的指令里。

二、智能体式 AI 给质量组织带来什么变化

What Agentic AI Changes for a Quality Organization

Most quality teams met generative AI as a chat window. Someone pasted in a deviation description, asked for a cleaner summary, copied the answer back into the QMS, and signed it. The human did every step that touched a system of record. The AI only answered.

多数质量团队第一次接触生成式 AI，是通过一个聊天窗口。有人把偏差描述粘进去，让它写一份更清爽的摘要，再把答案复制回 QMS，然后签下自己的名字。凡是碰到记录系统的步骤，都是人做的。AI 只负责回答。

Agentic AI removes that separation. Anthropic’s engineering guidance draws the line clearly: workflows are systems where language models and tools follow predefined code paths, while agents are systems where the model directs its own process and tool use and keeps control over how it completes the task.¹ The same guidance notes that agents plan and operate on their own once a task is clear, and may return to a human for information or judgment. It also warns that autonomy brings the potential for compounding errors and recommends testing in sandboxed environments with appropriate guardrails.¹

智能体式 AI 把这层分隔拆掉了。Anthropic 的工程指南把界线划得很清楚：工作流是语言模型和工具沿着预定义代码路径运行的系统，而智能体是模型自己主导过程、自己决定怎么用工具、并掌控任务如何完成的系统。¹ 同一份指南指出，任务一旦明确，智能体会自行规划、自行运行，也可能回头向人要信息或要判断。它同时警告，自主会带来误差累积的可能，并建议在沙箱环境里配上恰当的护栏做测试。¹

In a quality organization, that means an agent could open a deviation record, query the manufacturing execution system for the batch history, pull environmental monitoring results, search five years of past investigations, draft a root cause hypothesis, propose a CAPA, route it for approval, and set the due dates. Each of those steps is technically possible today. Some of them are fine to hand over. Some of them are not, and the reason is not the quality of the model. It is who the regulations say must decide.

放到质量组织里，这意味着一个智能体可以打开偏差记录、向制造执行系统查批次历史、拉环境监测结果、检索过去五年的调查、起草根因假设、提出 CAPA、把它送审，再设定到期日。这些步骤今天在技术上一个个都做得到。其中一些交出去没问题，另一些不行，而理由不在于模型好不好，在于法规规定必须由谁来决定。

从回答到动手

From Answering to Acting

The practical shift is from an AI that produces text a person then uses, to an AI that takes actions a person may or may not see before they take effect. That changes three things for quality leaders.

实际的变化是：从“产出文本、再由人去使用”的 AI，变成“直接采取动作、人在动作生效前不一定看得到”的 AI。这对质量负责人意味着三件事变了。

The review point moves. With a chat tool, the human review happens naturally, because the person has to copy the output somewhere. With an agent, review happens only where the system forces it.

复核点挪位了。用聊天工具时，人工复核是自然而然发生的，因为人必须把输出复制到某个地方去。换成智能体，复核只发生在系统强制它发生的地方。

The scope of access grows. An agent needs credentials to the QMS, LIMS, MES, and document management system to do useful work. Whatever those credentials allow, the agent can do.

访问范围扩大了。智能体要干有用的活，就需要 QMS、LIMS、MES 和文档管理系统的凭证。这些凭证允许什么，智能体就能做什么。

The error pattern changes. A single wrong answer in a chat is contained. A wrong intermediate result in an agent’s plan feeds every later step, which is exactly the compounding effect the Anthropic guidance describes.

出错模式变了。聊天里一个答错，影响是封闭的。智能体计划里一个错误的中间结果，会喂给它后面每一步，这正是 Anthropic 指南描述的累积效应。

ISPE’s Pharmaceutical Engineering reported in its July/August 2026 issue that several agentic AI tools built for root cause analysis, investigations, and CAPA were already demonstrated in 2026.² The same authors proposed a guardrail framework specifically to keep such tools from driving critical quality decisions on their own. The technology has arrived in the exact processes where the question of autonomy matters most.

ISPE 的《Pharmaceutical Engineering》在 2026 年 7/8 月刊里报道，面向根因分析、调查和 CAPA 的若干智能体式 AI 工具在 2026 年已经有了演示。² 同一批作者提出了一套护栏框架，专门用来防止这类工具自行驱动关键质量决策。技术已经抵达了自主性问题最要紧的那几个流程里。

自主是设计选择，不是能力的副产品

Autonomy Is a Design Choice, Not a Side Effect of Capability

A useful idea comes from researchers at the University of Washington. Feng, McDonald, and Zhang argue that an agent’s level of autonomy can be treated as a deliberate design decision, separate from its capability and the environment it works in.³ They define five levels by the role the user plays: operator, collaborator, consultant, approver, and observer. At the approver level, the user steps in only when the agent hits a blocker, which includes signing off on consequential actions. At the observer level, the user can watch activity logs and pull an emergency off-switch, but cannot redirect the work.³

华盛顿大学的研究者提出了一个有用的思路。Feng、McDonald 和 Zhang 认为，智能体的自主等级可以被当作一个审慎的设计决定，与它的能力、与它运行的环境分开来看。³ 他们按用户扮演的角色定义了五个等级：操作者、协作者、顾问、批准人、旁观者。在批准人这一级，用户只在智能体遇到阻塞时介入，包括对后果性动作签字放行。在旁观者这一级，用户可以看活动日志、可以拉下紧急停机开关，但不能改变工作的方向。³

This framing matters because vendors often present autonomy as a feature that comes with a more capable model. It does not have to. A highly capable agent can be deployed at a low autonomy level, and in quality operations it often should be. The capability decides what the agent could do. The quality organization decides what it may do.

这个框架要紧，因为厂商常把自主包装成“模型更强就自带”的功能。其实不必如此。一个高能力的智能体完全可以部署在低自主等级上，而在质量运营里往往就该这么办。能力决定智能体能做什么，质量组织决定它可以做什么。

三、法规已经对“谁来决定”说了什么

What the Rules Already Say About Who Decides

Before designing any oversight model, it helps to list the decisions that the regulations already assign to a specific person or unit. None of these rules mention AI agents. All of them constrain what an agent can be allowed to do.

在设计任何监督模型之前，先把法规已经指派给某个具体个人或部门的决定列一遍，会有帮助。这些规则没有一条提到 AI 智能体，但它们每一条都在约束智能体可以被允许做什么。

21 CFR 211 下质量控制部门的权限

The Quality Control Unit’s Authority Under 21 CFR 211

Under 21 CFR 211.22(a), the quality control unit has “the responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling, and drug products.”4 Paragraph (c) gives the same unit responsibility for approving or rejecting all procedures or specifications that affect the identity, strength, quality, and purity of the drug product, and paragraph (d) requires those responsibilities to be in writing.⁴

按 21 CFR 211.22(a)，质量控制部门拥有“批准或拒绝所有组分、药品包装容器、密封件、中间物料、包装材料、标签和药品的责任与权限”。⁴ (c) 段把批准或拒绝所有影响药品鉴别、含量、质量和纯度的规程或质量标准的责任给了同一个部门，(d) 段要求这些责任必须成文。⁴

Section 211.192 adds that production and control records “shall be reviewed and approved by the quality control unit to determine compliance with all established, approved written procedures before a batch is released or distributed.”5 The same section requires that any unexplained discrepancy or specification failure be thoroughly investigated, and that the investigation extend to other batches that may be associated with it, with a written record including conclusions and follow-up.⁵ Section 211.165 requires laboratory determination of conformance to final specifications for each batch before release, and states that drug products failing to meet specifications shall be rejected.⁶

211.192 条补充规定，生产和控制记录“在批次放行或分销之前，须由质量控制部门审查与批准，以判定其符合所有既定并经批准的书面规程”。⁵ 同一条还要求，任何无法解释的偏差或超标必须彻底调查，调查须扩展到可能与之相关的其他批次，并形成包含结论和后续措施的书面记录。⁵ 211.165 条要求每个批次放行前由实验室判定其是否符合最终质量标准，并规定不符合质量标准的药品应予拒收。⁶

The words that matter here are “approve,” “reject,” and “review and approve.” They describe acts of judgment by a unit of people with written responsibilities. An agent can prepare the evidence for those acts. It cannot be the one performing them.

这里要紧的词是“批准”“拒绝”和“审查并批准”。它们描述的是一群人的判断行为，这群人的责任是写下来的。智能体可以为这些行为准备证据，但它不能成为执行这些行为的那一方。

EU GMP Annex 16 下的合格人

The Qualified Person Under EU GMP Annex 16

In the EU, Annex 16 states that each batch of finished product must be certified by a Qualified Person (QP) within the EU before release for sale, supply, or export.⁷ The annex also contains a distinction that is directly useful for agent design. Section 1.6 lists operational responsibilities the QP must personally ensure before certification. Section 1.7 lists a longer set of checks (points 1.7.1 to 1.7.21) that may be delegated to appropriately trained personnel or third parties, and it notes that the QP will need to rely on the pharmaceutical quality system and should have ongoing assurance that this reliance is well founded.⁷

在欧盟，Annex 16 规定每批成品在上市、供应或出口放行前，必须由欧盟境内的合格人（QP）认证。⁷ 这份附件里还有一处区分，对智能体设计直接有用。1.6 节列出 QP 在认证前必须亲自确保的操作性职责。1.7 列出一组更长的核查项（1.7.1 至 1.7.21），这些可以委托给经过适当培训的人员或第三方，同时指出 QP 需要依赖药品质量体系，并且应当持续获得“这种依赖是有充分依据的”保证。⁷

Read with agents in mind, Annex 16 already separates preparation from certification. Many of the checks that feed a certification decision can be done by others under the quality system. The certification itself, and the personal responsibilities in 1.6, cannot be handed to anyone else. If an agent helps with the delegable checks, the QP’s reliance on it must be “well founded,” which in practice means validated, monitored, and documented.

带着智能体的视角去读，Annex 16 其实已经把“准备”和“认证”分开了。支撑认证决定的许多核查项，可以由别人在质量体系下完成。认证本身，以及 1.6 里的个人职责，不能交给任何其他人。如果智能体参与那些可委托的核查，QP 对它的依赖就必须“有充分依据”，落到实处就是经过验证、受到监测、有记录。

电子签名只属于个人

Electronic Signatures Belong to Individuals

21 CFR Part 11 defines an electronic signature as a computer data compilation of symbols “executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature.”8 Section 11.100(a) states: “Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.”9 Section 11.50 requires signed records to show the printed name of the signer, the date and time, and the meaning of the signature, “such as review, approval, responsibility, or authorship.”10

21 CFR Part 11 把电子签名定义为一组符号的计算机数据汇编，“由个人执行、采纳或授权，作为其手写签名具有法律约束力的等同物”。⁸ 11.100(a) 条规定：“每个电子签名应对应唯一个人，不得被他人再次使用或重新分配。”⁹ 11.50 条要求签名记录显示签名人的印刷体姓名、日期和时间，以及签名的含义，“如审查、批准、负责或著述”。¹⁰

An agent is not an individual. It cannot hold an electronic signature, and a person cannot lend it theirs. Any design where an agent acts under a person’s credentials and applies that person’s signature, even with the person’s agreement, breaks the link Part 11 exists to protect. The practical rule is simple: an agent may author a draft, and the record can say so. It may never be the signer of a review or approval.

智能体不是个人。它不能持有电子签名，人也不能把自己的借给它。任何让智能体用某个人的凭证行事、并落下那个人的签名的设计，即便本人同意，也破坏了 Part 11 要保护的那条链。实操规则很简单：智能体可以起草，记录可以这么写。但它永远不能是审查或批准的签名人。

Annex 22 草案说了什么，没说什么

What Draft Annex 22 Adds, and What It Does Not

The EU’s draft Annex 22 on artificial intelligence, published for consultation in July 2025, is the most direct regulatory statement on this subject. It is still a draft. There is no final text and no implementation date as of this writing, so treat it as a clear signal of inspector thinking, not as a requirement in force.

欧盟关于人工智能的 Annex 22 草案于 2025 年 7 月发布征求意见，是这个题目上最直接的监管表述。它目前仍是草案。到本文写作时没有终稿，也没有实施日期，所以应当把它看作检查员思路的清晰信号，而不是一项生效的要求。

The draft applies to AI models used in “critical applications with direct impact on patient safety, product quality or data integrity.”11 It covers only static models with deterministic output. It says that dynamic models and models with probabilistic output should not be used in critical GMP applications, and then states that the document does not apply to generative AI and large language models, and “such models should not be used in critical GMP applications.”11 For non-critical applications, the draft says “personnel with adequate qualification and training should always be responsible for ensuring that the outputs from such models are suitable for the intended use,” which it calls a human-in-the-loop.¹¹

草案适用于“对患者安全、产品质量或数据完整性有直接影响的关键应用”中使用的 AI 模型。¹¹ 它只覆盖输出确定性的静态模型。它说动态模型和概率输出模型不应用于关键 GMP 应用，接着又声明本文件不适用于生成式 AI 和大语言模型，并且“此类模型不应用于关键 GMP 应用”。¹¹ 对非关键应用，草案说“具备充分资质与培训的人员应始终负责确保此类模型的输出适合预期用途”，它把这称为 human-in-the-loop（人在环中）。¹¹

Agents of the kind Anthropic describes are, by definition, built on large language models. Under the draft, that places them outside critical GMP applications and inside a human-in-the-loop model for everything else. A 2026 paper in the PDA Journal of Pharmaceutical Science and Technology interpreting the July 2025 draft describes it as defining expectations for intended use, validation, life cycle management, explainability, and human-in-the-loop oversight.¹²

Anthropic 描述的那类智能体，按定义就是构建在大语言模型上的。按草案，这把它们放到了关键 GMP 应用之外，放到了其余一切的 human-in-the-loop 模式里。《PDA Journal of Pharmaceutical Science and Technology》2026 年一篇解读 2025 年 7 月草案的论文，把它描述为对预期用途、验证、生命周期管理、可解释性和人在环中监督作出了期望规定。¹²

The joint FDA and EMA Guiding Principles of Good AI Practice in Drug Development, released in January 2026, point the same way without setting specific rules. Principle 2 calls for proportionate validation, risk mitigation, and oversight based on the context of use and model risk. Principle 8 says “Risk-based performance assessments evaluate the complete system including human-AI interactions.”13 The principles cover manufacturing as well as nonclinical, clinical, and post-marketing uses.

FDA 与 EMA 于 2026 年 1 月联合发布的《药物研发中良好 AI 实践指导原则》指向同一方向，但没有设定具体规则。原则 2 要求按使用情境和模型风险，做相称的验证、风险缓减和监督。原则 8 说“基于风险的绩效评估应评估包含人机交互在内的完整系统”。¹³ 这套原则覆盖生产，也覆盖非临床、临床和上市后用途。

（原表为英文，此处逐格对照翻译，内容未作删改。）

四、质量运营中自主权的决策框架

A Decision Framework for Autonomy in Quality Operations

The regulations tell us where the fixed points are. They do not tell a quality leader what to do with the hundreds of smaller tasks between a deviation being logged and a batch being released. For that, we need a way to sort tasks.

法规告诉我们固定点在哪里，但没有告诉质量负责人，从偏差登记到批次放行之间那几百件小活该怎么处理。要解决这个，我们需要一个给任务分类的办法。

从工作类型出发，不从流程出发

Start With the Type of Work, Not the Process

A long-standing model from human factors research is a good place to start. In 2000, Parasuraman, Sheridan, and Wickens proposed that automation can be applied to four broad classes of functions: information acquisition, information analysis, decision and action selection, and action implementation. Each can be automated at a different level, from fully manual to fully automatic, and one system can mix levels across the four.¹⁴ They also observed that automation “does not merely supplant but changes human activity and can impose new coordination demands on the human operator.”14

人因研究里一个沿用多年的模型是个不错的起点。2000 年，Parasuraman、Sheridan 和 Wickens 提出，自动化可以作用于四大类功能：信息获取、信息分析、决策与行动选择、行动执行。¹⁴ 每一类可以在不同等级上被自动化，从全手动到全自动，同一个系统可以在这四类上混用不同等级。他们还观察到，自动化“不只是取代人的活动，而是改变人的活动，并可能给人的操作者带来新的协调负担”。¹⁴

This split is more useful than asking whether “deviation management” or “batch release” can be automated, because every quality process contains all four types of work. A deviation investigation includes gathering records (acquisition), comparing them to past events (analysis), choosing a root cause and a CAPA (decision), and updating the QMS record (implementation). The right level of autonomy differs across those four steps inside the same process.

这种切分比问“偏差管理”或“批次放行”能不能自动化更有用，因为每个质量流程都包含全部四类工作。一次偏差调查包括：收集记录（获取）、与历史事件比对（分析）、选定根因和 CAPA（决策）、更新 QMS 记录（执行）。同一个流程里，这四步对应的正确自主等级各不相同。

Gather

Information Acquisition

Finding and pulling records: batch history, EM data, training records, past deviations, supplier certificates. Read-only by nature. Generally suitable for high autonomy.

信息获取
查找并调取记录：批次历史、EM 数据、培训记录、历史偏差、供应商合格证。本质上是只读的。通常适合高自主。

Analyze

Information Analysis and Drafting

Summarizing, comparing, trending, drafting narratives and hypotheses. Output is a proposal. Suitable for autonomy when a qualified person reviews each output before use.

信息分析与起草
汇总、比对、做趋势、起草叙述和假设。产出是一份提案。当有资质的人在每份产出使用前复核时，适合自主。

Decide

Decision Selection

Classifying severity, selecting a root cause, choosing a CAPA, judging reportability, dispositioning product. The agent may recommend. The decision belongs to a named person.

决策选择
定严重程度、选根因、定 CAPA、判定可报告性、处置产品。智能体可以建议。决定属于一个具名的人。

Act

Action Implementation

Writing to a GxP record, changing a status, approving, releasing, signing. Low-impact administrative actions can be automated under control. Approvals, releases, and signatures cannot.

行动执行
写入 GxP 记录、改状态、批准、放行、签名。低影响的行政动作可以在受控下自动化。批准、放行和签名不行。

四级监督层级

Four Oversight Levels

With the type of work identified, each task can be placed at one of four oversight levels. We describe them by what the human does, following the user-role approach from Feng and colleagues, but tied to GxP accountability rather than general software use.

工作类型确定后，每个任务可以被放到四个监督层级之一。我们按“人做什么”来描述它们，沿用 Feng 等人的用户角色思路，但绑定的是 GxP 问责，而不是一般软件使用。

A　A 级：智能体在只读边界内行动，人负责监测

Level A: Agent Acts Within a Read-Only Boundary, Humans Monitor

The agent gathers, searches, compiles, and flags without writing to any GxP record. Humans review activity logs and sample outputs on a set schedule. Suitable for information acquisition and for alerts that start a human process.

智能体收集、检索、汇总、标记，不写入任何 GxP 记录。人按既定周期复核活动日志并抽样检查产出。适合信息获取，以及用于启动人工流程的告警。

B　B 级：智能体起草，具名的人复核并认领每一份产出

Level B: Agent Drafts, a Named Person Reviews and Owns Every Output

The agent produces drafts, summaries, and proposals. Nothing enters the record until a qualified person has reviewed, edited as needed, and taken ownership. The record shows who reviewed it. Suitable for analysis and drafting.

智能体产出草稿、摘要和提案。在有资质的人复核、按需修改并认领之前，任何内容都不进入记录。记录会显示是谁复核的。适合分析和起草。

C　C 级：智能体建议，人做决定，且决定记在人名下

Level C: Agent Recommends, a Person Decides and the Decision Is Recorded as Theirs

The agent offers a classification or option with its reasoning and evidence. A named person makes the call, with the ability and the time to disagree. Suitable for triage and other decisions where the agent’s input is one of several inputs.

智能体给出一个分类或选项，连同它的推理和证据。一个具名的人做决定，并且有能力、有时间不同意。适合分诊，以及智能体输入只是多个输入之一的那些决定。

D　D 级：决定点上只留人

Level D: Human Only at the Point of Decision

The agent may have supplied inputs earlier through Levels A to C, but it has no role in the act itself and no system permission to perform it. Required for release, certification, final disposition, GxP record approval and signature, and reportability decisions.

智能体可能在前面的 A 到 C 级提供过输入，但它在这个动作本身中没有角色，也没有执行该动作的系统权限。放行、认证、最终处置、GxP 记录批准与签名、可报告性判定都要求这一级。

Note what is missing. There is no level where the agent acts on a GxP record and the human merely observes. In the Feng framework, that would be the observer level, where the user can watch logs and use an off-switch but cannot direct the work.³ For quality decisions under current regulations, we do not see a place for it. Observer-style autonomy can be acceptable for non-GxP administrative tasks, but those fall outside this framework.

注意这里缺了什么。不存在这样一个层级：智能体对 GxP 记录动手，而人只是旁观。在 Feng 框架里，那对应旁观者级，用户可以看日志、可以用停机开关，但不能指挥工作。³ 就现行法规下的质量决定而言，我们看不到它的位置。旁观者式自主对非 GxP 的行政任务可以接受，但那落在这套框架之外。

四问测试

The Four-Question Test

To place a task, ask four questions in order. The first “yes” that points to a higher level of control settles the answer.

要给任务定级，按顺序问四个问题。第一个指向更高控制级别的“是”，就是答案。

Is the step assigned by regulation or by your quality procedures to a named person or unit? Release, certification, approval or rejection of product, approval of procedures and specifications, and signature all fall here. If yes: Level D.

这个步骤是否被法规或你的质量规程指派给了一个具名的人或部门？放行、认证、产品批准或拒收、规程和质量标准的批准、签名都在此列。如果是：D 级。

Does the step create, change, or approve content in a GxP record? If yes, and it is not a Level D act, the agent may draft but a named person must review and own the content before it becomes part of the record: Level B at minimum.

这个步骤是否在 GxP 记录中创建、修改或批准内容？如果是，且它不是 D 级动作，那么智能体可以起草，但内容成为记录一部分之前，必须由一个具名的人复核并认领：至少 B 级。

Could a wrong output reach product or patient, or change a regulatory commitment, before an independent human check catches it? If yes, the agent may recommend but may not decide: Level C at minimum, and often Level D.

在一个独立的人工检查抓住它之前，一个错误产出有没有可能触及产品或患者，或者改变一项监管承诺？如果有，智能体可以建议但不能决定：至少 C 级，通常是 D 级。

Is the step read-only, and would any error be caught by the human process it feeds? If yes, Level A is acceptable, provided the agent’s access is technically limited to reading.

这个步骤是否只读，且任何错误都会被它所服务的人工流程抓住？如果是，A 级可以接受，前提是智能体的访问在技术上被限制为只读。

One more filter runs across all four questions: the type of model. If the agent is built on a large language model, the draft Annex 22 position is that it should not be used in critical GMP applications, and that qualified personnel should be responsible for its outputs in non-critical ones.¹¹ Even though the annex is not final, a quality organization that places an LLM-based agent at Level A for anything with a direct effect on patient safety, product quality, or data integrity should expect to defend that choice at inspection.

还有一道筛子横跨四个问题：模型的类型。如果智能体构建在大语言模型上，Annex 22 草案的立场是它不应用于关键 GMP 应用，在非关键应用中应由有资质的人员对其输出负责。¹¹ 尽管附件尚未定稿，一个把基于 LLM 的智能体放到 A 级、用于任何对患者安全、产品质量或数据完整性有直接影响的事情的质量组织，应当预期自己要在检查中为这个选择作辩护。

Why Order Matters.

Teams that start with question four (“is it low risk?”) tend to talk themselves into autonomy. Starting with question one forces the conversation to begin with accountability. If a regulation or your own SOP names a person, the discussion about the agent’s accuracy is not needed.

为什么顺序要紧。从第四个问题（“它风险低吗？”）开始的团队，往往会把自己说服到自主上去。从第一个问题开始，能迫使对话从问责起步。如果法规或你自己的 SOP 已经点名了某个人，那就没必要再讨论智能体的准确度。

五、哪些地方可以接受自主

Where Autonomy Is Acceptable

The good news for quality teams is that a large share of the work that slows investigations and reviews is information gathering and drafting. Those are the areas where agents can take on real work without crossing any of the fixed lines above.

对质量团队来说，好消息是：拖慢调查和复核的工作里，很大一块是信息收集和起草。这些正是智能体可以承接真实工作、又不会跨过上面任何一条红线的区域。

数据收集与证据组装（A 级）

Data Gathering and Evidence Assembly (Level A)

ISPE’s guardrail article describes the problem well: investigations require pulling data from the QMS, MES, LIMS, change control, training records, and SOPs, and quality professionals must query each system by hand, export data, and look for correlations, a process that leaves room for error and incomplete analysis.² An agent that assembles this evidence pack is doing information acquisition. If its access is read-only, it cannot change a record. If the investigator reviews the pack before relying on it, any gap or wrong pull is caught in the normal course of the investigation.

ISPE 的护栏文章把这个问题描述得很到位：调查需要从 QMS、MES、LIMS、变更控制、培训记录和 SOP 里取数，质量专业人员必须逐个系统手工查询、导出数据、再找相关性，这个过程给错误和不完整分析留了空间。² 一个负责组装这套证据包的智能体，做的是信息获取。如果它的访问是只读的，它改不了记录。如果调查员在依赖这个包之前先复核，任何缺漏或拉错都会在调查的正常过程中被发现。

Typical Level A tasks in quality operations include:

质量运营中典型的 A 级任务包括：

Retrieving the batch record, equipment logs, environmental monitoring results, and material certificates for a batch under investigation.

为受调查批次调取批次记录、设备日志、环境监测结果和物料合格证。

Searching past deviations, investigations, and CAPAs for similar events by product, equipment, failure mode, or supplier.

按产品、设备、失效模式或供应商，检索历史偏差、调查和 CAPA 中的相似事件。

Compiling the document set for an Annual Product Quality Review or a periodic review.

为年度产品质量回顾或定期回顾汇总文档集。

Checking that every deviation linked to a batch is closed before the batch reaches the release queue, and flagging any that are not.

核查与某批次关联的每个偏差在批次进入放行队列前都已关闭，并标记未关闭的。

Sending reminders on CAPA due dates, overdue training, or open change control tasks.

就 CAPA 到期日、逾期培训或未关闭的变更控制任务发送提醒。

The last two items show that Level A can include actions, as long as those actions do not change a GxP record or make a quality decision. A flag that says “two linked deviations are still open” starts a human process. It does not hold, release, or reject anything.

最后两项说明，A 级也可以包含动作，只要这些动作不改变 GxP 记录、不做出质量决定。一条“两个关联偏差仍未关闭”的标记会启动一个人工流程。它不会搁置、放行或拒收任何东西。

起草（B 级）

Drafting (Level B)

Drafting is where many quality teams see the first large time savings, and it is acceptable autonomy as long as the draft does not become the record without a person taking ownership. Good Level B candidates include:

起草是许多质量团队看到第一笔大幅时间节省的地方，只要草稿没有在人认领的情况下变成记录，它就是可接受的自主。好的 B 级候选包括：

First drafts of deviation descriptions and immediate-action summaries from operator notes and system data.

根据操作员记录和系统数据，起草偏差描述和即时措施摘要的初稿。

Investigation report sections that describe the timeline, the data reviewed, and the hypotheses considered.

调查报告中描述时间线、所审阅数据和所考虑假设的章节。

Proposed CAPA wording and effectiveness check criteria.

CAPA 建议措辞和有效性检查标准。

Change control impact assessments that list affected documents, systems, validations, and training.

列出受影响文件、系统、验证和培训的变更控制影响评估。

Redlines of SOPs after a CAPA, prepared for the document owner’s review.

CAPA 之后的 SOP 红线稿，供文件负责人审阅。

Narrative sections of an Annual Product Quality Review, with the underlying data tables linked.

年度产品质量回顾的叙述章节，并链接底层数据表。

Level B works only if the review is substantive. The reviewer needs the agent’s sources alongside the draft, so they can check claims rather than read prose. ISPE’s framework makes the same point: every AI response in its model includes citations to source documents, the reasoning from data to conclusion, confidence scores, and alternative hypotheses when confidence is moderate.² A draft without its evidence invites approval by reading rather than approval by checking.

B 级要成立，复核必须是实质性的。复核者需要把智能体的来源和草稿放在一起，这样他们核查的是论断，而不是读散文。ISPE 的框架讲的是同一个意思：它的模型里每一条 AI 响应都包含对源文件的引用、从数据到结论的推理、置信度评分，以及置信度中等时的备选假设。² 一份不带证据的草稿，招来的是“读着批准”，而不是“查过批准”。

监测与早期信号（A 级喂给 C 级）

Monitoring and Early Signals (Level A Feeding Level C)

Agents can watch data streams and quality records continuously in a way no team can. Trending deviations by equipment, spotting a rise in a specific failure mode, or noticing that a supplier’s certificates changed format are all useful signals. The agent’s job is to raise the signal with its evidence. What happens next, whether to open an investigation, notify a supplier, or escalate to management, is a decision and belongs at Level C or D.

智能体能以任何团队都做不到的方式，持续盯住数据流和质量记录。按设备给偏差做趋势、发现某个失效模式在上升、注意到某供应商的合格证换了格式，这些都是有用的信号。智能体的职责是把信号连同证据提出来。接下来怎么办，是立案调查、通知供应商，还是向管理层上报，这是决定，属于 C 级或 D 级。

A Sound Pattern for Acceptable Autonomy.

The agent reads broadly, writes only drafts or flags, shows its sources, and hands off to a named person at every point where a GxP record would change. That pattern captures most of the time savings in investigations and reviews while leaving every regulated decision where the regulations put it.

一个稳妥的可接受自主模式。智能体广泛地读，只写草稿或标记，展示它的来源，并在每一个会改变 GxP 记录的节点上交给一个具名的人。这个模式吃到了调查和复核里绝大部分的时间节省，同时把每一个受监管的决定留在法规放它的位置上。

六、哪些地方不能接受自主

Where Autonomy Is Not Acceptable

The list of Level D tasks is shorter, and it should be treated as fixed unless the regulations change. These are acts, not analyses. An agent can contribute to the work that comes before them, but not to the act itself.

D 级任务的清单更短，而且除非法规改变，就应当把它当作固定的。这些是动作，不是分析。智能体可以为这些动作之前的工作做贡献，但不能参与动作本身。

批次放行与 QP 认证

Batch Release and QP Certification

Release is the clearest case. Under 211.22 and 211.192, the quality control unit approves or rejects drug products and reviews and approves production and control records before a batch is released or distributed.^4,5 In the EU, the QP certifies each batch.⁷ An agent may run a pre-release completeness check and present an exceptions list. It should have no system permission to change a batch status to released, and no role that could be read as the release decision.

放行是最清楚的例子。按 211.22 和 211.192，质量控制部门批准或拒收药品，并在批次放行或分销前审查批准生产和控制记录。⁴⁵ 在欧盟，每个批次由 QP 认证。⁷ 智能体可以做一次放行前完整性检查，并给出一份例外清单。它不应有把批次状态改成“已放行”的系统权限，也不应承担任何可能被解读为放行决定的角色。

This holds even for “review by exception” designs, where the system presents only the anomalies for human review. Review by exception is a common approach for electronic batch records. What makes it acceptable is that the exception rules are defined, validated, and deterministic, and that a person still makes the release decision. An LLM-based agent deciding what counts as an exception is a different thing, and under the draft Annex 22 position it would be a probabilistic model used in a critical application.¹¹

即便对“例外复核”式设计，这条也成立，也就是系统只把异常呈给人复核。例外复核是电子批次记录的常见做法。它之所以可接受，是因为例外规则是定义好的、经过验证的、确定性的，并且仍然由人做放行决定。让一个基于 LLM 的智能体来决定什么算例外，是另一回事，按 Annex 22 草案的立场，那就是在关键应用里使用概率模型。¹¹

产品与物料的最终处置

Final Disposition of Product and Materials

Approving, rejecting, quarantining for reprocessing, or releasing materials and product are the quality unit’s decisions under 211.22(a).⁴ Section 211.165 states that drug products failing to meet specifications shall be rejected, and that reprocessed material must meet appropriate standards before acceptance.⁶ An agent can compile test results, compare them to specifications, and highlight out-of-specification values. It must not set the disposition.

批准、拒收、为返工而隔离、放行物料和产品，这些都是 211.22(a) 下质量部门的决定。⁴ 211.165 条规定不符合质量标准的药品应予拒收，返工物料在接受前必须达到适当标准。⁶ 智能体可以汇总检验结果、与质量标准比对、标出超标值。它不能定处置。

GxP 记录批准与电子签名

Approval of GxP Records and Electronic Signatures

No agent should approve an investigation report, a CAPA plan, a change control, a validation deliverable, a batch record, or any other GxP record. Part 11 ties each electronic signature to one individual and requires the meaning of the signature to be shown.^9,10 An approval that was generated by an agent and applied under a person’s account is not that person’s approval, whatever the system shows.

任何智能体都不应批准调查报告、CAPA 计划、变更控制、验证交付物、批次记录或任何其他 GxP 记录。Part 11 把每个电子签名绑定到唯一个人，并要求显示签名的含义。⁹¹⁰ 一个由智能体生成、挂在某人账户下落下的批准，无论系统怎么显示，都不是那个人的批准。

The same applies to approving procedures and specifications, which 211.22(c) assigns to the quality control unit.⁴ An agent may redline an SOP. The document owner and quality approver sign it.

批准规程和质量标准同理，211.22(c) 把这交给了质量控制部门。⁴ 智能体可以给 SOP 划红线。文件负责人和质量批准人签字。

最终根因与调查关闭

Final Root Cause and Investigation Closure

Section 211.192 requires discrepancies to be thoroughly investigated, the investigation extended to other potentially affected batches, and a written record made with conclusions and follow-up.⁵ An agent can propose hypotheses and even rank them. Selecting the root cause, deciding which other batches are affected, and closing the investigation are decisions. ISPE’s framework, even for its lower-severity categories, keeps a human reviewing findings before anything is approved, and for serious problems requires human signoff before any corrective action is taken.²

211.192 条要求对偏差彻底调查、把调查扩展到其他可能受影响的批次、并形成含结论和后续措施的书面记录。⁵ 智能体可以提假设，甚至给假设排序。选定根因、判定哪些其他批次受影响、关闭调查，这些是决定。ISPE 的框架即便在较低严重度类别里，也保持人在任何批准前复核发现，而对严重问题，要求任何纠正措施实施前有人签字。²

监管可报告性

Regulatory Reportability

Some quality events trigger reporting obligations with short deadlines. Under 21 CFR 314.81, an NDA applicant must submit a Field Alert Report within three working days of receiving information about, for example, bacteriological contamination or a distributed batch failing its specification.¹⁵ An agent can and should help here, by flagging events that may meet the criteria and assembling the facts quickly. Whether the event is reportable, and what the report says, is a regulatory judgment. It stays with the people accountable for it.

有些质量事件会触发报告义务，且限期很短。按 21 CFR 314.81，NDA 申请人在获知例如细菌污染或已分销批次不符合质量标准这类信息后，须在三个工作日内提交现场警报报告（FAR）。¹⁵ 智能体可以、也应当在这里帮忙，标记可能符合条件的事件并快速汇集事实。事件是否可报告、报告怎么写，这是监管判断。它留在对它负责的人那里。

Level D Tasks: No Agent Permission, Not Just No Agent Intent.

For release, certification, disposition, record approval and signature, procedure and specification approval, final root cause and closure, and reportability decisions, the agent’s service account should not hold the system permission to perform the action. Telling an agent not to do something is an instruction. Removing its ability to do it is a control.

D 级任务：不给权限，不只是不打算做。对放行、认证、处置、记录批准与签名、规程和质量标准批准、最终根因与关闭、可报告性判定，智能体的服务账户不应持有执行该动作的系统权限。告诉智能体不要做某事，那是一条指令。拿走它做这件事的能力，那才是一项控制。

七、灰色地带：分诊、分类与关闭建议

The Gray Zone: Triage, Classification, and Closure Recommendations

The hardest cases are not release or drafting. They are the recommendations that come between them: classifying a deviation as minor, major, or critical; recommending that no CAPA is needed; proposing that an event is an isolated occurrence; suggesting an investigation can close. These are Level C tasks. The agent recommends and a named person decides. The difficulty is making sure the person’s decision is real.

最难的案例不是放行，也不是起草。而是介于两者之间的那些建议：把一个偏差定成轻微、重大还是关键；建议不需要 CAPA；提出某事件是孤例；建议某项调查可以关闭。这些是 C 级任务。智能体建议，具名的人决定。难处在于确保那个人的决定是真的。

自动化偏见是主要风险

Automation Bias Is the Main Risk

Automation bias is described in a 2012 systematic review by Goddard, Roudsari, and Wyatt as “the tendency to over-rely on automation.”16 The review screened 13,821 papers and included 74. It found that environmental factors, including workload, task complexity, and time constraint, mediated over-reliance by putting pressure on cognitive resources. It also found that mitigators included training, emphasizing user accountability, attaching updated confidence levels to the system’s output, and providing information rather than a recommendation.¹⁶

Goddard、Roudsari 和 Wyatt 在 2012 年的一篇系统综述里，把自动化偏见描述为“过度依赖自动化的倾向”。¹⁶ 该综述筛了 13,821 篇论文，纳入 74 篇。它发现，工作负荷、任务复杂度和时间限制等环境因素，通过挤压认知资源来中介过度依赖。它还发现，缓减因素包括培训、强调用户问责、给系统输出附上更新后的置信度，以及提供信息而不是给出建议。¹⁶

Every one of those mediators is present in a busy quality unit: high volume, complex events, and deadlines. That is the environment in which a reviewer is most likely to accept a triage recommendation without independent thought. A Level C design that ignores this becomes Level D in name and Level A in practice.

这些中介因素在一个繁忙的质量部门里全都有：量大、事件复杂、有期限。这正是复核者最可能不假思索就接受分诊建议的环境。一个无视这点的 C 级设计，名义上是 D 级，实际是 A 级。

让人的决定保持真实的设计选择

Design Choices That Keep the Human Decision Real

Present evidence before the recommendation. Show the data the agent used, and let the reviewer form a view, before showing the agent’s classification. The Goddard review lists providing information rather than a recommendation as a mitigator.¹⁶

先给证据，再给建议。先展示智能体用的数据，让复核者形成自己的看法，然后再展示智能体的分类。Goddard 综述把“提供信息而不是给出建议”列为一项缓减因素。¹⁶

Allow the agent to say “undecided.” The draft Annex 22 suggests that where a model’s confidence score is very low, it should be considered whether the model should flag the outcome as “undecided” rather than making a potentially unreliable classification.¹¹ An agent that always gives an answer trains reviewers to expect one.

允许智能体说“无法判定”。Annex 22 草案建议，当模型的置信度很低时，应当考虑让模型把结果标记为“无法判定”，而不是做一个可能不可靠的分类。¹¹ 一个总给答案的智能体，会训练复核者期待答案。

Route by severity, not by agent confidence alone. ISPE’s framework ties oversight to risk: in its worked example, a critical patient safety event went to the highest oversight category even though its calculated risk score pointed one level lower, and all AI hypotheses required expert validation before the investigation could proceed.²

按严重程度分流，不要只按智能体的置信度。ISPE 的框架把监督与风险绑定：在它的算例里，一起严重的患者安全事件被送进最高监督类别，即便算出来的风险分数指向低一级，并且所有 AI 假设在调查推进前都需专家验证。²

Record the human’s decision separately from the agent’s recommendation. The QMS should show what the agent proposed, what the person decided, and whether they agreed. That record is also your best evidence at inspection.

把人的决定与智能体的建议分开记录。QMS 应当显示智能体提议了什么、人决定了什么、以及两者是否一致。这份记录也是你在检查中最好的证据。

Protect reviewer time. If throughput targets assume a two-minute review for an agent-classified deviation, the review will take two minutes whether or not the classification is right.

保护复核者的时间。如果产能指标假定对智能体分类过的偏差只做两分钟复核，那么不论分类对不对，复核就只会花两分钟。

监测复核者，不只是监测智能体

Monitor the Reviewer, Not Only the Agent

Draft Annex 22 contains a line that deserves more attention than it gets. Where a model gives input to a decision made by a human operator, and testing effort on the model has been reduced on that basis, “the training and consistent performance of the operator should be monitored like any other manual process.”11 Section 10.5 adds that records should be kept of the human review, and depending on criticality, this may mean consistent review or test of every output.¹¹

Annex 22 草案里有一行字，值得比它通常得到的更多注意。当模型给人工操作者的决定提供输入，并因此减少了对模型的测试投入时，“操作者的培训与一贯表现应当像任何其他手工过程一样受到监测。”¹¹ 第 10.5 节补充说，应当保留人工复核的记录，并视关键程度，这可能意味着对每一份输出做一致的复核或测试。¹¹

In practice, that means measuring things like how often reviewers change the agent’s classification, how long reviews take, and whether override rates differ sharply between reviewers. An override rate near zero across hundreds of recommendations is not proof that the agent is excellent. It may be proof that nobody is checking. The FDA and EMA principles make the same point from the other direction: performance assessment should cover the complete system, including human-AI interactions.¹³

落到实处，这意味着要测量诸如：复核者多常改动智能体的分类、复核花多长时间、不同复核者之间的推翻率是否差别巨大。几百条建议下来推翻率接近零，不能证明智能体很出色。它可能证明的是没人在查。FDA 和 EMA 的原则从另一个方向说了同一件事：绩效评估应当覆盖包含人机交互在内的完整系统。¹³

偏差分类

Deviation classification

附证据建议轻微、重大或关键

智能体可以 ｜ Propose minor, major, or critical with evidence

决定分类，并作为自己的决定记录

人必须 ｜ Decide the classification and record it as theirs

复核者改动率；决定耗时

要监测的信号 ｜ Rate of reviewer changes; time to decision

是否需要 CAPA

CAPA need

附推理和相似历史事件，建议做或不做 CAPA

智能体可以 ｜ Recommend CAPA or no CAPA with reasoning and similar past events

做决定，尤其是任何“不做 CAPA”的结论

人必须 ｜ Decide, especially any “no CAPA” outcome

无 CAPA 关闭事件的复发情况

要监测的信号 ｜ Recurrence of events closed without CAPA

影响范围

Scope of impact

列出共用设备、物料或工艺步骤的其他批次或产品

智能体可以 ｜ List other batches or products that share equipment, materials, or process steps

判定哪些受影响、需要调查

人必须 ｜ Decide which are affected and require investigation

后续发现首轮复核漏掉的受影响批次

要监测的信号 ｜ Later discoveries of affected batches missed at first review

调查关闭

Investigation closure

按规程核查完整性并标记缺口

智能体可以 ｜ Check completeness against the procedure and flag gaps

判断根因充分并批准关闭

人必须 ｜ Judge the root cause adequate and approve closure

重新打开的调查；重复出现的根因

要监测的信号 ｜ Reopened investigations; repeat root causes

可报告性筛查

Reportability screening

标记可能符合报告标准的事件并汇集事实

智能体可以 ｜ Flag events that may meet reporting criteria and assemble facts

判定可报告性并批准内容

人必须 ｜ Decide reportability and approve content

从事件到决定的时间，对照限期

要监测的信号 ｜ Time from event to decision against the deadline

（原表为四列英文表格，手机上横向排列可读性差，此处改为逐行卡片，四列内容全部保留。）

八、把边界做进系统，而不是做进提示词

Build the Boundaries Into the System, Not the Prompt

The most common design mistake we see in early agent projects is enforcing the autonomy level through the agent’s instructions. A system prompt that says “never approve a record” is not a GxP control. The model may follow it most of the time. A control is something that works every time, whether or not the model behaves.

我们在早期智能体项目里最常见的设计错误，是通过智能体的指令来强制自主等级。一句“绝不批准记录”的系统提示词不是 GxP 控制。模型大概率会遵守它。控制是那种每次都管用的东西，不论模型表不表现。

过度代理是一个已知风险类别

Excessive Agency Is a Known Risk Category

The OWASP Gen AI Security Project lists Excessive Agency as one of its top risks for LLM applications. It defines the risk as the vulnerability that allows damaging actions in response to unexpected, ambiguous, or manipulated model outputs, whatever the cause, and names three root causes: “excessive functionality; excessive permissions; excessive autonomy.”17 Its mitigations translate directly to quality systems:

OWASP Gen AI Security Project 把“过度代理”（Excessive Agency）列为 LLM 应用的首要风险之一。它把这个风险定义为：允许在模型输出出现意外、含糊或被操纵时（不论原因）发生破坏性动作的漏洞，并点出三个根因：“功能过度、权限过度、自主过度。”¹⁷ 它的缓减措施可以直接平移到质量系统上：

Minimize the tools and functions available to the agent. An agent that drafts investigation reports needs to read records and write drafts. It does not need a tool that can change record status.

把智能体可用的工具和功能减到最少。一个起草调查报告的智能体需要读记录、写草稿。它不需要一个能改记录状态的工具。

Minimize permissions. The agent’s service account in the QMS should have exactly the rights its oversight level allows, and no more.

把权限减到最少。智能体在 QMS 里的服务账户，应当恰好拥有其监督层级允许的权利，不多一分。

Require human approval for high-impact actions. OWASP’s guidance is to “require a human to approve high-impact actions before they are taken,” and notes this can be implemented in the downstream system.¹⁷

高影响动作要求人工批准。OWASP 的指引是“在高影响动作实施前要求一个人批准”，并指出这可以在下游系统里实现。¹⁷

Use complete mediation. OWASP recommends implementing authorization “in downstream systems rather than relying on an LLM to decide if an action is allowed or not.”17

使用完全中介。OWASP 建议把授权实现“放在下游系统里，而不是靠 LLM 来决定某个动作是否被允许。”¹⁷

Log and monitor agent actions. Logging does not prevent excessive agency, but it limits damage by making unwanted actions visible.

记录并监测智能体的动作。日志不能防止过度代理，但它通过让不想要的动作可见来限制损害。

不要让智能体决定什么算“后果性”

Do Not Let the Agent Decide What Is Consequential

Feng and colleagues raise a design problem at their approver level that applies directly to quality: an agent may be instructed to seek approval before consequential actions, but reliably determining which actions are consequential may be challenging.³ In a quality system, the list of consequential actions should never be left to the agent’s judgment. It should be defined in your procedures, mapped to specific transactions in each system, and enforced by those systems. The four-question test earlier in this article is one way to build that list.

Feng 等人在他们的批准人级别上提出一个设计问题，这个问题直接适用于质量：可以指示智能体在后果性动作前先寻求批准，但要可靠地判定哪些动作是后果性的，可能很困难。³ 在一个质量系统里，后果性动作的清单绝不该交给智能体的判断。它应当定义在你的规程里，映射到每个系统的具体事务上，并由这些系统强制执行。本文前面的四问测试，就是编制这份清单的一种办法。

给智能体它自己的身份

Give the Agent Its Own Identity

An agent should act under its own non-human account, never under a person’s credentials. That keeps the audit trail honest about who did what, and it keeps Part 11 signatures tied to the individuals who executed them.⁹ It also makes the permission model visible: an auditor can look at the agent’s account and see exactly what it is able to do.

智能体应当用它自己的非人账户行事，绝不用某个人的凭证。这让审计追踪如实反映谁做了什么，也让 Part 11 的签名始终绑定到执行它们的个人。⁹ 它同时也让权限模型可见：审核员可以看智能体的账户，准确看到它能做什么。

把人这一侧的角色定下来

Assign Roles for the Human Side

The NIST AI Risk Management Framework includes two items that fit here. GOVERN 3.2 calls for policies and procedures that define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems. MAP 3.5 calls for processes for human oversight to be defined, assessed, and documented.¹⁸ For a quality organization, that becomes a simple document: for each agent, which tasks it performs at which level, which role reviews or decides at each hand-off, and how that review is monitored.

NIST 的 AI 风险管理框架里有两项适合这里。GOVERN 3.2 要求有定义并区别人机配置角色与职责、以及 AI 系统监督的政策和规程。MAP 3.5 要求人工监督的过程被定义、评估和记录。¹⁸ 对一个质量组织来说，这就成了一份简单的文件：对每个智能体，它在哪个层级做哪些任务，每次交接由哪个角色复核或决定，以及这个复核如何被监测。

A Control Checklist for Each Agent.

Its own service account. Read-only access by default, with write access only to draft fields. No permission to change status on any Level D transaction. Human approval enforced by the target system for every GxP record change. Agent authorship recorded in the audit trail. The agent and its permission set under change control. A named owner who reviews its activity logs on a set schedule.

每个智能体的控制清单。有它自己的服务账户。默认只读，写权限只给草稿字段。无权更改任何 D 级事务的状态。每一次 GxP 记录变更，由目标系统强制人工批准。智能体的作者身份记入审计追踪。智能体本身及其权限集纳入变更控制。有一位具名负责人，按既定周期复核它的活动日志。

九、一个务实的起步顺序

A Practical Starting Sequence

For quality leaders who want to move from pilot to controlled use, we suggest the following sequence. It is deliberately conservative at the start, because the fastest way to lose the organization’s trust in agents is an inspection finding in the first year.

对想从试点走到受控使用的质量负责人，我们建议下面的顺序。它在开头刻意保守，因为让组织失去对智能体信任最快的办法，就是第一年吃一张检查缺陷单。

1　先把决定映射出来，再映射任务

Map the Decisions Before the Tasks

For one process, such as deviation management, list every decision and every record approval, with the regulation or SOP that assigns it. These are your Level D points. Everything else is a candidate for Levels A to C.

针对一个流程，比如偏差管理，列出每一个决定和每一次记录批准，并注明是哪条法规或 SOP 指派的。这些就是你的 D 级点。其余一切都是 A 到 C 级的候选。

2　对余下每一步跑四问测试

Run the Four-Question Test on Each Remaining Step

Assign each step an oversight level and a named role for the human side. Split steps that mix gathering and deciding, so each part gets the right level.

给余下每一步指定一个监督层级和人这一侧的一个具名角色。把“收集”和“决定”混在一起的步骤拆开，让每一部分拿到正确的级别。

3　先从 A 级起步，再加入 B 级

Start at Level A, Then Add Level B

Evidence assembly and read-only search come first. They carry the least risk and build familiarity. Add drafting once reviewers have a way to see sources beside every draft.

先做证据组装和只读检索。它们风险最小，也能建立熟悉度。等复核者有了在每份草稿旁看到来源的办法，再加入起草。

4　C 级一上线就带上监测

Introduce Level C With Monitoring From Day One

Before any triage recommendation goes live, decide how you will measure reviewer agreement, review time, and outcomes. Draft Annex 22 expects operator performance to be monitored like any manual process.

在任何分诊建议上线之前，先决定你要怎么测量复核者一致性、复核时间和结果。Annex 22 草案期望操作者表现像任何手工过程一样受到监测。

5　用权限和变更控制来强制层级

Enforce Levels Through Permissions and Change Control

Set the agent’s system permissions to match its level, put those permissions under change control, and treat any request to raise an agent’s autonomy as a change with a documented risk assessment.

把智能体的系统权限设成与它的层级匹配，把这些权限纳入变更控制，并把任何提高智能体自主等级的请求当作一次变更处理，附书面风险评估。

This sequence is slower at the start than a broad rollout, and that is deliberate. In regulated work, the controls designed in at the beginning are what keep a useful agent in production after its first inspection. An agent that is permitted to do less, and can show exactly what it did and who decided, is easier to defend, easier to extend, and easier to trust across the quality organization.

这个顺序比全面铺开要慢，这是刻意的。在受监管的工作里，一开始就设计进去的控制，才是一个有用的智能体在第一次检查之后还能留在生产中的原因。一个被允许做得更少、又能准确展示它做了什么、谁做了决定的智能体，更容易辩护，更容易扩展，也更容易在整个质量组织里获得信任。

采购前要问厂商的问题

Questions to Ask a Vendor Before You Buy

Many quality teams will meet agents first as features inside an eQMS, LIMS, or document management product rather than as something they build. The same framework applies, and a few questions make the conversation concrete:

许多质量团队第一次接触智能体，是作为 eQMS、LIMS 或文档管理产品里的一个功能，而不是自己造的东西。同一套框架照样适用，几个问题就能把谈话落到实处：

Which actions can the agent take in the system, and can each one be switched off or limited by role?

智能体在系统里能执行哪些动作，其中每一个是否都能被关闭或按角色限制？

Does the agent act under its own account, or under the logged-in user’s account?

智能体用它自己的账户行事，还是用当前登录用户的账户？

Can the system enforce human approval on specific transactions, independent of the agent’s instructions?

系统能不能对特定事务强制人工批准，且这件事独立于智能体的指令？

What model does the agent use, can its version change without notice, and how will we know?

智能体用什么模型，它的版本会不会在我们不知情的情况下变更，我们怎么会知道？

Does the audit trail show what the agent proposed separately from what the person decided?

审计追踪是否把智能体提议的内容与人决定的内容分开显示？

Can the agent return “undecided” or “insufficient evidence,” or does it always give an answer?

智能体能不能返回“无法判定”或“证据不足”，还是它总给一个答案？

A vendor who can answer these clearly has thought about regulated use. A vendor who answers with accuracy figures alone has not yet been asked the right question.

能清清楚楚回答这些的厂商，是认真想过受监管使用的。只用准确度数字回答的厂商，是还没被问到对的问题。

十、结论

Conclusion

Agentic AI in quality operations does not need a new theory of accountability. The accountability is already written down. The quality control unit approves and rejects. The QP certifies. An electronic signature belongs to one person. The draft Annex 22 keeps large language models out of critical GMP applications and puts a qualified person behind every output in non-critical ones. What quality leaders need is a consistent way to apply those fixed points to the many small steps inside each process. A four-level oversight model, sorted by a four-question test that starts with accountability rather than accuracy, gives them that. Agents can gather, draft, monitor, and recommend. People decide, approve, release, and sign. And the line between the two is enforced by system permissions, not by the agent’s good behavior.

质量运营里的智能体式 AI 不需要一套新的问责理论。问责已经写在那里了。质量控制部门批准和拒收。QP 认证。电子签名属于一个人。Annex 22 草案把大语言模型挡在关键 GMP 应用之外，并在每一个非关键应用里把一个有资质的人放在每份产出背后。质量负责人需要的，是一套把这些固定点一致地应用到每个流程内部许多小步骤上的办法。一个从问责而不是从准确度起步的四问测试所分出的四级监督模型，给的就是这个。智能体可以收集、起草、监测、建议。人决定、批准、放行、签名。两者之间的那条线，由系统权限来强制，而不是靠智能体表现好。

资料来源：Sakara Digital 官方博客《Agentic AI in Quality Operations: Where Autonomy Stops》，作者 Amie Harpe，2026 年 10 月 13 日，https://sakaradigital.com/blog/agentic-ai-quality-operations-autonomy/

说明：本文为原文中英对照转载，英文段照原文逐字保留、未作删改，中文段为对照译文；如有出入，以英文原文为准。