System Design 04 — Sovereign / Air-Gapped AI Deployment

"Deploy our platform to a regulated, air-gapped customer (defence/finance/ healthcare/government)." The JD's sovereign-AI nice-to-have, taken seriously. Phases: 11 (security/licensing), 07 (serving Ch. 9), 09 (portability), 10 (ops Ch. 9).

1. Drive the requirements

  • Air-gap level: no network ever from deployment to vendor, or periodic out-of-band? Sets activation/update flow (P11 Ch. 5).
  • What's protected: just licensing, or model weights + customer data from the operator too (→ confidential computing, P11 Ch. 9)?
  • Hardware: customer-provided, possibly heterogeneous (→ HAL, P09).
  • Compliance: data residency, auditability, certification requirements.

Assume: fully air-gapped, weights are our IP to protect, customer-provided mixed hardware, strict audit requirements.

2. Architecture

   [customer's air-gapped environment]
   +--------------------------------------------------------------+
   | Platform (HAL-portable, P09) on the customer's hardware       |
   |   Offline license gate (P11) - signed, hardware-bound         |
   |   Serving (P07) - admission/goodput matter MORE (no burst)    |
   |   Local-only observability (P10 Ch. 9) - no telemetry egress  |
   |   Weights encrypted at rest; decrypt only inside an attested  |
   |     TEE / GPU confidential computing (P11 Ch. 8-9)            |
   |   Tamper-evident audit logs                                   |
   +--------------------------------------------------------------+
              ^  out-of-band only (activation, updates)
   [vendor side: activation service, signing key in HSM]

3. The hard decisions (and tradeoffs)

  • Licensing without a server (P11 Ch. 4–5): Ed25519-signed, offline-verified, hardware-bound (fuzzy fingerprint) license; challenge-response activation out-of-band; bounded grace + clock-rollback resistance. Tradeoff: revocation is hard air-gapped → shorter terms + re-activation.
  • Protecting weights (P11 Ch. 8–9): the strong tier — weights encrypted at rest, decrypted only inside an attested TEE / GPU confidential computing, gated on a valid attestation. Tradeoff: requires the hardware feature; self-checks/ obfuscation alone are only cost-raisers (state honestly).
  • No phone-home (P07/P10 Ch. 9): offline everything — weights, license, telemetry, updates. Reshapes packaging and the update story.
  • Heterogeneous customer hardware (P09): the HAL makes the platform portable to whatever they have — a key reason sovereign customers can deploy at all.
  • Fixed capacity (P07 Ch. 9): no elastic burst → admission control and goodput discipline matter more.

4. Supply-chain & audit

  • Supply-chain integrity: signed artifacts, reproducible builds, SBOMs — the customer trusts what you shipped without watching you build it.
  • Auditability: tamper-evident logs of access and operations (regulated requirement); data-residency guarantees enforced in the serving layer.
  • Updates: signed update bundles carried in out-of-band; verified offline like licenses.

5. The honest-claims discipline (P11 Ch. 1)

State exactly what each control guarantees and its limit:

  • Signed license: economic + legal control; defeated by patching the verifier → hence anti-tamper + attestation.
  • Attestation: proves what loaded, not bug-freeness; trust root must be sound.
  • Confidential computing: protects weights/data from the host, gated by attestation. Never claim "uncrackable" — credibility is the product in this market.

6. Commercial framing (P12 Ch. 6)

This is a defensible, high-margin market a cloud-assuming competitor structurally cannot serve: a customer who needs "runs unmodified, only on licensed hardware, data never leaves the attested enclave, fully air-gapped, auditable" can only buy from a platform built for it. The same hardware-agnostic + security core also wins cost-conscious lock-in-averse customers. Security here is a market-access feature with direct revenue impact — which is why the Head of Engineering owns it alongside the HAL it protects.

The senior signal

You composed the HAL (portability), offline licensing + air-gap activation (P11), attestation + confidential computing for weights (the strong tier), and local-only ops (P10 Ch. 9) into a coherent sovereign architecture — and you stated the honest limits of each control. That honesty, plus the market-access commercial framing, is exactly the judgment the JD's sovereign-AI mandate demands.