Infrastructure No egress by design Controlled-media updates

Air-gapped deployment.
No way out.

An air gap is not a stricter firewall. It is the absence of a route. Everything an ordinary deployment takes for granted — package installs, model downloads, telemetry, licence checks — has to be redesigned around that, and most AI tooling assumes otherwise.

WHY THE TOOLING FIGHTS YOU

Modern AI infrastructure assumes connectivity in places nobody documents. A serving framework downloads weights on first run. A tokeniser fetches a config from a model hub. A dependency resolves at build time. An observability agent posts to a collector. A licence check phones home on start. Each is invisible in a connected environment and each is a hard failure behind an air gap — often at the worst possible moment, because several only trigger on restart.

So the first deliverable in an air-gapped build is not the model. It is an inventory of every point at which the stack reaches outward, and a decision for each one: vendor it, mirror it internally, or remove it. That work is unglamorous, it is most of the schedule, and skipping it is the most common reason we would expect an air-gapped AI project to fail late rather than early.

HOW IT WORKS INSTEAD

CONTROLLED-MEDIA PIPELINE

Staging build

connected, outside the gap
Bundle

weights · images · deps
Sign & hash

provenance record
Transfer

controlled media
Verify & deploy

inside the gap
Evaluate in place

local harness, no callbacks

Solid: the only permitted direction of travel

Everything crosses the boundary as a signed, hashed bundle on controlled media. Nothing crosses back.

WHAT HAS TO BE REBUILT

Model delivery

Weights are staged, hashed and signed outside the gap, transferred on controlled media and verified inside it. Version and hash are recorded, which incidentally produces exactly the provenance trail an auditor asks for.

Dependency mirroring

An internal registry holding every package, container image and model artefact the system needs. Populated deliberately rather than resolved at build time, because a build that reaches the internet is a build that will fail inside the gap.

Observability without egress

Traces, metrics and evaluation results land in a local stack. Reporting leaves as an exported artefact on the same controlled path the updates came in on, reviewed by a human before it goes.

Evaluation in place

The eval harness and its datasets live inside the gap. You cannot benchmark against a hosted model from in here, so the regression gate has to be entirely self-contained — which is a discipline worth having anyway.

WHO ACTUALLY NEEDS THIS

Defence and government classified environments, where isolation is typically required by policy. Critical national infrastructure — energy, water, transport control systems — where the operational network is isolated as a matter of engineering practice. Some manufacturing and pharmaceutical process networks. Occasionally a research environment holding material whose leak would be existential.

It is worth being direct: most organisations that ask for an air gap need on-premise. On-premise already means no data egress, and it keeps the operational sanity of being able to pull a security patch. The air gap adds a genuine increment of assurance and a large increment of operational burden, and it is the right trade only where a policy or a threat model actually requires it. We will say so if we think it does not, because inheriting an unnecessary air gap is a decade-long tax on every future change.

QUESTIONS

QUESTIONS — 4

On a deliberate cycle rather than continuously. A new version is staged and evaluated outside the gap, bundled with its dependencies, signed, transferred and verified inside. Often quarterly, on a cycle you set. The upside of the friction is that nothing changes without someone deciding it should, which is a property regulated environments generally want anyway.

No, and that is the trade. Inside a true air gap there is no route to any hosted service, so the ceiling is whatever open-weight model you deployed. If some workload genuinely needs frontier capability, it has to live in a different environment with its own boundary — and pretending otherwise is how air gaps get quietly holed.

It removes one large class of risk and leaves the others intact. Prompt injection through ingested documents, excessive agent permissions, insider misuse and supply-chain compromise of what you carried across the gap all still apply. We threat-model the system on its own terms; the gap is one control among several, not a conclusion.

We scope eight to sixteen weeks, and the driver is almost never the AI. It is the dependency inventory, the internal mirror and the approval process for the transfer procedure. That is a design target we plan to, not a measured client outcome.

Keep reading

Security Architecture

30-minute technical call · no deck