Sovereign Engineering · Air-gapped AI
What Is Air-Gapped AI? Isolation, Runtime Controls and Operational Readiness
Air-gapped AI runs inside an environment separated from external networks, with explicitly controlled procedures for moving material across the boundary. Useful isolation depends on the whole workflow: model files, retrieval, tools, identity, authorization, logs, updates, and recovery.
The network boundary constrains connectivity. Runtime authorization constrains what the agent may do inside it.
By Cyber Strategy InstituteUpdated Framework source: AI SAFE² v3.1
Intake environment · outside the enclave
Enclave A · isolation boundary
External update material arrives in a separate intake environment. It has not touched the enclave.
Verify origin and integrity. The hash is compared with an approved baseline. Agreement with a baseline still depends on how that baseline was approved.
Review decision. Accept the material for transfer, or reject it to quarantine with a recorded reason.
Rejected at review. The item stays in quarantine outside the enclave, and the reason is recorded. The running version is unchanged.
Approved transfer procedure. Controlled and recorded. It must not create an unreviewed network bridge.
Internal staging. The material lands inside the boundary, separate from the running workflow.
Local tests. Run inside the enclave. Pass to continue, or fail back to quarantine.
Failed local tests. The item moves to quarantine and the failure is recorded. The running version is unchanged.
Authorized promotion. A named operator promotes the new version, and the decision is recorded.
Versioned runtime with rollback. Version 4.2 runs. Version 4.1 stays available for rollback.
01 · TL;DR
When is air-gapped AI worth the cost?
At a glance
TL;DR
- Define the isolation boundary and every permitted transfer path before choosing a model.
- Local inference can still depend on external registries, identity, license checks, or other services.
- Isolation does not make model output deterministic or eliminate internal misuse.
- Verify imports, restrict local tool authority, and preserve locally usable evidence.
- Cold-start and recover the complete workflow without external connectivity.
- Core objective
- Useful AI under a declared isolation and authority boundary
- Deployment prerequisite
- All required runtime dependencies available inside the enclave
- Key maintenance problem
- Controlled import, verification, promotion, and rollback
- Strongest evidence
- Observed cold-start, denied-action, update, and recovery tests
- Common blind spot
- The model is local, but its authentication or package dependency is remote
Air-gapping is worth the cost when the threat model demands a stronger separation boundary than restricted egress — and only after the dependency manifest shows the full workflow can cold-start, authorize, log, and recover inside the enclave. If any required service still needs an external route, or the risk is local misuse rather than network intrusion, a restricted-egress environment with tested permission design delivers most of the benefit at a fraction of the operating burden.
02 · The problem
The problem: a disconnected model is only one component
An enclave can lose external connectivity and still permit an agent to overwrite local records, disclose one user's files to another, or corrupt a shared retrieval corpus. Isolation limits routes; permission design limits actions.
Disconnected deployment is an established infrastructure capability. Red Hat publishes documentation for installing OpenShift AI in disconnected environments.1 The buyer's next question is whether the intended workload, its support services, and its operating procedures meet the declared boundary.
There is no universal percentage that proves your enclave is ready. Count unresolved external dependencies in your own manifest. One required remote authorization service can invalidate a claim of autonomous disconnected operation.
03 · Dependency manifest
Disconnected dependency manifest
List every component the workflow needs to start and operate. Add rows for anything specific to your stack. Stays in your browser; download it as CSV.
| Component | Version | Source | Local copy | External need | Update owner | Restore test |
|---|---|---|---|---|---|---|
| Model weights | ||||||
| Serving runtime | ||||||
| Drivers and firmware | ||||||
| Retrieval index | ||||||
| Identity provider | ||||||
| Policy engine | ||||||
| Evidence store | ||||||
| Time source | ||||||
| License service |
Use only three values: Documented, Tested (add the date in the row), or Unknown. Do not display "air-gap certified" or a readiness percentage.
04 · Architecture
How a governed enclave works
Use three architectural primitives.
- Verified importApprove the origin, version, integrity, license, and review status of material before promotion.
- Restricted local executionGive each agent the tools, data, and operation types its task requires. Keep enforcement outside model-editable instructions.
- Local evidence and recoveryMake identity, authorization, revocation, logging, and restoration work inside the boundary for the required operating period.
Consider a maintenance assistant that searches equipment manuals. It can read approved manuals and draft instructions. An equipment-state change needs a separate authorization path. Removing internet access does not grant that authority.
# Illustrative enclave requirements manifest, not executable settings.
workflow: maintenance-manual-assistant
boundary: enclave-a
runtime_network:
external_routes: none
management_paths: documented-and-reviewed
local_services: [inference, retrieval, identity, policy, evidence, time]
tool_grants: [manuals.read, draft.write]
state_change:
default: deny
authorization: named-operator
imports:
promotion_requires: [origin_review, integrity_check, security_review]AIR-02 · Import process
Import without silently joining two trust zones
- External update material
- Separate intake environment
- Verify origin and integrity
- Review accepted?NoQuarantine and record
- Approved transfer procedure
- Internal staging environment
- Local tests pass?NoQuarantine and record
- Authorized promotion
- Versioned runtime and rollback
05 · The governance gap
The governance gap: local harm remains possible
Deterministic policy checks can reject a prohibited tool action even when the model proposes it. That property belongs to the implemented authorization boundary. It does not follow from an air gap, a model name, or a system prompt.
Treat exfiltration claims with the same precision. Validate network interfaces, management paths, removable media, approved exports, and the specified physical threat model. Evidence of blocked internet traffic supports a bounded network claim. It does not establish the absence of every possible information channel.
If required authorization is unavailable, the protected action must stop. Separately define which read-only or recovery operations remain permitted. Operators need a clear explanation of the blocked action and a controlled way to restore service.
That property belongs to the implemented authorization boundary. It does not follow from an air gap, a model name, or a system prompt.
06 · Control mapping
AI SAFE² control mapping
These mappings identify relevant governance requirements. They do not certify an air gap or validate a particular enclave.23456
| Published control | Application inside the enclave | Evidence to request |
|---|---|---|
| CP.2Adversarial ML Threat Model Integration | Define internal misuse, imports, delayed poisoning, and permitted channels | Enclave-specific threat model |
| CP.4Agentic Control Plane Governance | Keep local identity and action authority explicit | Grants, owners, revocation records |
| CP.8Catastrophic Risk Threshold Controls | Define when consequential operations must stop | Threshold decisions and suspension exercise |
| CP.10HEAR Doctrine | Maintain named, independently usable stopping authority where required | Local halt-path evidence |
| S1.5Memory Governance Boundary Controls | Restrict and record persistent memory writes | Authorized and denied write traces |
| A2.3Model Lineage Provenance Ledger | Track model origins and approved changes | Model manifest and promotion record |
| F3.5Multi-Agent Cascade Containment | Contain internal workflow failures | Failure-injection and recovery report |
HEAR: Human Ethical Agent of Record, the named person with stopping authority
07 · Compare
Compare deployment boundaries
| Approach | Connectivity assumption | Useful when | Control question |
|---|---|---|---|
| Connected on-premises | External services remain available | Local hosting is required but connectivity is allowed | Which data and actions can cross the boundary? |
| Restricted-egress environment | Explicit external destinations are allowed | Selected online dependencies are necessary | Are routes and identities constrained and tested? |
| Disconnected operation | Required workflow runs without online services | Connectivity is unavailable or intentionally suspended | Can it start, authorize, log, and recover offline? |
| Air-gapped architecture | Runtime separated from external networks; controlled transfers | The threat model requires a stronger separation boundary | Are transfer and management paths included in assurance? |
These are operational descriptions. Document the exact boundary instead of relying on a label.
08 · Test your claim
Test your claim: cold-start the factory
Use a controlled test environment and synthetic data. Begin with external connectivity unavailable.
- StartRestart the full stack with external connectivity unavailable.
- AuthenticateAuthenticate an operator against local identity.
- ReadRun inference and retrieval on approved material.
- DenyAttempt a forbidden tool operation. It must be rejected.
- RevokeRevoke a grant and confirm it stops working.
- ReconstructReconstruct the resulting evidence from local records.
- UpdateApply an approved update through the import procedure.
- Roll backRoll back to the previous version and confirm operation.
Report attempted external connections separately from successful communications. Record how you observed them and where observation was incomplete.
Define the required operating duration and staffing before the test.
Fail the claim if
Fail the readiness claim if a required component cannot start, a protected action bypasses authorization, evidence cannot be reconstructed, or the update procedure violates the declared isolation boundary.
This is a test you can run against your deployment. No CSI result is reported here. Record the versions, permitted scope, observed actions, failures, and legitimate task completion before drawing a conclusion.
09 · FAQ
Frequently asked questions about air-gapped AI
What is air-gapped AI?
It is AI operated within a declared environment separated from external networks, with controlled information-transfer procedures. Document the boundary and permitted paths precisely.
Is on-premises AI automatically air-gapped?
No. On-premises describes location. A local server may still communicate with cloud identity, telemetry, software repositories, or remote management services.
Does air-gapping make an LLM deterministic?
No. Isolation and model generation are separate properties. You can implement deterministic authorization checks around a model within a defined boundary.
Can an isolated agent still cause damage?
Yes. It can misuse accessible files, tools, credentials, or local systems. Limit authority and test consequential operations.
How do you update an air-gapped AI system?
Use a documented intake, verification, transfer, staging, promotion, and rollback process. Preserve evidence of what changed and who authorized it.
Does Warden secure the whole enclave?
Evaluate Warden for the specific containment role and configuration in scope. Endpoint protection is one component of the broader deployment architecture; its applicable behavior needs evidence.
10 · Next steps
What to do next
- Write down the isolation boundary and permitted transfer paths.
- Inventory every dependency needed to start and operate the workflow.
- Assign local owners for identity, policy, updates, evidence, and recovery.
- Run the cold-start and denied-action exercise.
- Close the most consequential readiness gap before increasing authority.
The challengeDoes the full workflow remain useful and governed inside the boundary, including identity, evidence, updates, and recovery?
Assess the authority inside the boundary
Use the assessment to establish a governance starting point. A technical isolation review and disconnected readiness test require their own defined scope.
11 · Sources and method
Sources and method
Sources
- Red Hat, OpenShift AI Self-Managed documentation. Disconnected deployment guidance; not a sovereign outcome guarantee.
- Cyber Strategy Institute, Cross-Pillar Governance Layer, pinned source. Requirements and reference patterns, not evidence of installed coverage.
- Cyber Strategy Institute, CP.5.MCP Server Security Profile, pinned source. Profile applicability depends on deployment; the adapter scaffolding status remains explicit.
- Cyber Strategy Institute, Pillar 2, Audit & Inventory, pinned source. A listed trace requirement does not prove access to private model reasoning.
- Cyber Strategy Institute, Pillar 3, Fail-Safe & Recovery, pinned source. Behavior and containment need deployment-specific tests.
- Cyber Strategy Institute, Pillar 1, Sanitize & Isolate, pinned source. Memory governance needs an implemented authorization boundary.
Method
Sources reviewed . AI SAFE² is cited from its October 15, 2026 release. Framework documents identify v3.1; the NEXUS README identifies v0.6.0. These version numbers describe different artifacts. Control mappings are editorial applicability mappings, not conformance determinations. Every CSI exercise on this page is a proposed test; no CSI result is reported.
Update log
- : page published.
About
Published by Cyber Strategy Institute, author of the AI SAFE² framework.