An air gap is not a stricter firewall. It is the absence of a route. Everything an ordinary deployment takes for granted — package installs, model downloads, telemetry, licence checks — has to be redesigned around that, and most AI tooling assumes otherwise.
Modern AI infrastructure assumes connectivity in places nobody documents. A serving framework downloads weights on first run. A tokeniser fetches a config from a model hub. A dependency resolves at build time. An observability agent posts to a collector. A licence check phones home on start. Each is invisible in a connected environment and each is a hard failure behind an air gap — often at the worst possible moment, because several only trigger on restart.
So the first deliverable in an air-gapped build is not the model. It is an inventory of every point at which the stack reaches outward, and a decision for each one: vendor it, mirror it internally, or remove it. That work is unglamorous, it is most of the schedule, and skipping it is the most common reason we would expect an air-gapped AI project to fail late rather than early.
connected, outside the gap
weights · images · deps
provenance record
controlled media
inside the gap
local harness, no callbacks
Defence and government classified environments, where isolation is typically required by policy. Critical national infrastructure — energy, water, transport control systems — where the operational network is isolated as a matter of engineering practice. Some manufacturing and pharmaceutical process networks. Occasionally a research environment holding material whose leak would be existential.
It is worth being direct: most organisations that ask for an air gap need on-premise. On-premise already means no data egress, and it keeps the operational sanity of being able to pull a security patch. The air gap adds a genuine increment of assurance and a large increment of operational burden, and it is the right trade only where a policy or a threat model actually requires it. We will say so if we think it does not, because inheriting an unnecessary air gap is a decade-long tax on every future change.
On a deliberate cycle rather than continuously. A new version is staged and evaluated outside the gap, bundled with its dependencies, signed, transferred and verified inside. Often quarterly, on a cycle you set. The upside of the friction is that nothing changes without someone deciding it should, which is a property regulated environments generally want anyway.
No, and that is the trade. Inside a true air gap there is no route to any hosted service, so the ceiling is whatever open-weight model you deployed. If some workload genuinely needs frontier capability, it has to live in a different environment with its own boundary — and pretending otherwise is how air gaps get quietly holed.
It removes one large class of risk and leaves the others intact. Prompt injection through ingested documents, excessive agent permissions, insider misuse and supply-chain compromise of what you carried across the gap all still apply. We threat-model the system on its own terms; the gap is one control among several, not a conclusion.
We scope eight to sixteen weeks, and the driver is almost never the AI. It is the dependency inventory, the internal mirror and the approval process for the transfer procedure. That is a design target we plan to, not a measured client outcome.
If your environment requires it, we build for it — starting with the egress inventory nobody enjoys.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
