Concepts · The Operating Layer
There is a class of work in operationally complex organisations that AI alone cannot solve.
This is the story of one such piece of work — and the substrate Tellefsen builds underneath it.
The Pattern
When the work spans systems, requires lineage, and carries regulatory teeth.
Every operationally complex organisation has work like this. A change in one place must be traced through dozens of others. The trace touches multiple systems, draws on years of history, must be auditable to a regulator, and must compound learning across the organisation so the next person doing similar work is not starting from zero. Today, this kind of work is done by hunting — by people moving between systems, assembling context by hand, and remembering what they can about precedent.
Banks call it model risk management. Ministries call it policy impact assessment. Utilities call it grid reliability review. Aviation operators call it safety management. Healthcare systems call it clinical change control. The names differ; the structure is identical. In each case the work is regulated, multi-system, lineage-dependent, and currently done by assembly rather than by query.
AI does not solve this. A chatbot over your documents does not solve this. A copilot inside one of your systems does not solve this. None of them solve it because none of them are the missing layer — the substrate that connects the systems, holds the lineage, and lets the work be queried rather than assembled. That layer is what Tellefsen builds. We call it the Operating Layer.
Rather than describe the Operating Layer abstractly, we will show it through one piece of work — Management of Change at a high-hazard refinery. The pattern is general; this case is concrete. If you do not work in process industries, mentally substitute the equivalent in your own world. The architecture is the same.
A major Gulf integrated energy operator. A refinery in Sohar. A reliability engineer who needs to raise the operating pressure of a heat exchanger.
01
Today — eight to twelve days of hunting.
A reliability engineer at a Gulf refinery wants to raise the operating pressure of heat exchanger E-12503 in the Hydrocracker unit from 22 barg to 26 barg, to recover throughput lost since the last turnaround. This is a process change. Process Safety Management regulations require a formal Management of Change — an MOC.
This is what the next two weeks of her life look like.
- 01She fills out the MOC form in the HSE system.
- 02She searches SharePoint for the latest P&IDs. Three revisions exist. She loses a day confirming which is current.
- 03She opens the HAZOP study from 2018. She has to read it to determine whether the requested pressure is inside the study envelope. It isn't.
- 04She searches SAP PM for past work orders on E-12503. Fourteen entries since 2014. She reads each one.
- 05She asks the senior process engineer — retiring next year — whether anything similar has been done at any of the operator's other facilities. He half-remembers a change at the methanol plant. He isn't sure.
- 06She searches the procedure library for SOPs and emergency response procedures that reference the unit. She finds three. They will need updating.
- 07She identifies which operators are competent on the unit and whether retraining is required.
- 08She waits for the weekly multi-disciplinary review meeting.
- 09She assembles the packet for the Pre-Startup Safety Review.
Elapsed time, MOC submission to scope-complete review packet: eight to twelve working days. Most of it is hunting, cross-referencing, and waiting. None of it requires judgement that a person should be doing by hand.
The data exists. The substrate to connect it does not.
02
The same request, on the Operating Layer.
The engineer enters the request. Within thirty seconds, the substrate composes the answer.
MOC Request
Raise E-12503 operating pressure from 22 to 26 barg.
Composed Response
~28 sec · 8 sources
AFFECTED P&IDS
GRAPHThree drawings identified, current revisions confirmed. Four downstream equipment items whose design basis is affected by the proposed pressure change.
Provenance: Document graph · Engineering DMS · revision-aware
EQUIPMENT HISTORY · E-12503
GRAPHFourteen prior work orders since 2014. Two prior MOCs: 2019 tube bundle replacement, 2022 control valve upgrade. Canonical-plus-version timeline available.
Provenance: SAP PM · canonical equipment record · 12 years
CROSS-ENTITY PRECEDENT
GRAPHSimilar change executed at the operator's methanol facility in 2021. Full MOC record, scope, lessons learned. Two findings worth reviewing.
Provenance: MOC graph · cross-facility · authority: HSE
HAZOP ENVELOPE CHECK
SCRIPTHAZ-2018-HCU-04 covers operating pressure up to 24 barg only. Requested 26 barg is outside study envelope. HAZOP re-evaluation required before approval.
Provenance: HAZOP database · deterministic envelope compare
DOCUMENTS REQUIRING UPDATE
GRAPHSOP-OQBI-0142 (Hydrocracker operations), alarm setpoint table A-HCU-007, emergency response procedure ERP-HCU-03. All linked, all flagged.
Provenance: Procedure graph · equipment-linked references
TRAINING IMPACT
GRAPHEleven operators competent on the Hydrocracker need procedural retraining. Roles and current training status visible. Assignment is by the unit supervisor, not by the system.
Provenance: Competency system · role-linked · current as of today
APPROVAL CHAIN
GRAPHMulti-disciplinary reviewers required for a pressure change of this magnitude, per the operator's MOC procedure. Current MOC backlog visible per reviewer.
Provenance: MOC procedure · live reviewer workload
DRAFT MOC SCOPE DOCUMENT
AIAuto-generated from the graph above. Every claim cites a source node and the authority that established it. Ready for the engineer to review and edit.
Provenance: Composed by AI · all citations link to graph nodes above
Eight-to-twelve days, compressed into one morning. With better completeness than the hand-assembled version — because nothing was missed in the hunting.
03
Two ways to do the same work.
Today
8–12
Working days · MOC scoping
- Hunting across systems
- Cross-referencing by hand
- Remembering precedent
- Manual document discovery
- Waiting for review meetings
- Assembling the packet
Most of the time is not judgement.
On the Operating Layer
<30
Seconds · to assembled answer
- Graph traversal across systems
- Cross-entity precedent surfacing
- Canonical-plus-version on equipment state
- Deterministic safety envelope checks
- AI for what genuinely needs it
- Provenance on every claim
The judgement is still the engineer's.
Before you go on
Would you rather read this as a PDF? The full brief is 12 pages — same case, more detail, downloadable for distribution inside your organisation.
04
Why this is architecture, not features.
Every AI product can show a demo. The question is what is underneath. Three structural differences distinguish what was just shown from a chatbot, a copilot, or a private-deployment AI platform.
01.The data is connected, not searched.
A chatbot over your documents still searches. A copilot inside your HSE system still searches. What was shown above does not search — it traverses. The P&IDs, the equipment history, the procedures, the training records, the work orders are all nodes in one graph, connected by their real operational relationships. The substrate makes the connection structural. The reader is not waiting for a search result; the answer is composed from the graph in a single pass.
02.The execution mode is chosen, not assumed.
Most AI products are AI-first by default. Every question is a model call. That is wrong for safety-critical work. The HAZOP envelope check is not a judgement; it is a logical comparison and it must never be approximated. A script does it deterministically. The cross-entity precedent is a graph traversal — no AI needed. The draft scope document is genuinely a language task — AI is the right tool. The substrate decides per sub-question. The execution-mode badges in the response above are visible deliberately: the architecture is not hidden.
03.The lineage is structural, not assembled.
Every claim shown to the engineer carries provenance — the source node, the authority, the timestamp. When she submits the MOC packet for review, the reviewer is not asked to trust the system; they can trace any element back to its source. When the regulator audits a year later, the lineage is queryable, not reconstructed. Lineage as a structural property of the substrate is what makes the work auditable by architecture rather than by promise.
These are architectural properties of the layer underneath. They cannot be retrofitted onto a chatbot. They cannot be added to a deployment platform. They are what an Operating Layer is for.
05
The architecture, briefly.
The Operating Layer is what Tellefsen builds. Every Operating Layer has the same four components. In this case, here is what each one is.
Context Graph
The ontology layer
The model of the business — entities, relationships, lifecycle events. The ontology that turns raw system records into something that can be reasoned over.
In this case
Facilities, units, equipment, MOCs, procedures, HAZOPs, training records, work orders — all connected nodes.
Orchestration
The runtime
How agents, scripts and AI models are composed, sequenced, and handed off — with human-in-the-loop gates where it matters.
In this case
The runtime that decides per sub-question whether the right tool is a graph traversal, a script, or an AI call.
Governance
The control layer
Permissions, audit, redaction, approval gates, evaluation hooks, structural lineage on every derived claim.
In this case
Recommend-and-human-approves on every action. Provenance carried on every block of the response.
Connectors
The bridges
Read-from-and-write-back-to bridges to the systems of record — never replacing them, always reading their truth.
In this case
SAP PM, the HSE system, the document estate, the HAZOP software, the training system — all bridged, none replaced.
Same four components in every Tellefsen engagement. Different ontology, different substrate, different sector. Same architecture.
There is a second story buried in this case. The MOC at the refinery becomes a node in the graph. A year later, the same operator's gas networks business is scoping a similar change at a compression station. The substrate surfaces the refinery's experience — the scope decisions, the lessons learned, the things that went wrong — as the top precedent, with full provenance. The work compounds. Not because anyone wrote a knowledge base. Because the architecture connects the records. This is the difference between an organisation that runs on systems and an organisation that runs on an Operating Layer.
The substrate is the foundation. The work that runs on it compounds for as long as it exists.
06
How an operator engages Tellefsen.
The Tellefsen Engagement Model
From operating gap to operating layer in one quarter.
Every engagement runs on the same three-stage rhythm. Fixed price, fixed outcome, our risk — never time-and-materials. Each stage delivers operational value on its own and earns the next.
01
Sprint
8–12 WEEKS · START HERE
We sit with the firm, map the substrate it has, find the operating gap, and produce the Operating Layer Map — the signed-off picture of what gets built and what it returns.
Deliverable
Operating Layer Map · signed off
02
Build
~90 DAYS · FIRST DEPLOYMENT
The first slice of the operating layer, built live in the client's environment to a fixed outcome. Not a pilot — a production system, owned by the client at hand-over.
Deliverable
Production operating layer · keys handed over
03
Retain
ONGOING · OPERATE & EXTEND
The layer operates and evolves — new domains, new ministries, sovereign models plugged in when ready. Each addition extends the substrate without rebuilding it.
Deliverable
Living operating layer · monthly investment
Fixed price · fixed outcome · our risk · never time-and-materials
The Operating Layer is what operationally complex organisations build when AI alone is not enough. The case shown here is one of many. The architecture is the same. The substrate is the same. Tellefsen builds it for the operator and hands them the keys.
Fixed price · 8–12 weeks · Operating Layer Map signed off