Air-Gapped AI for a Defense Program

The operational problem

Classified programs cannot send text to a hosted model, and they cannot accept an AI system that lacks an auditable record of what it read and what it produced. The blocker is rarely model quality — it is packaging, update mechanics, identity integration, and audit.

What Enfuse built

• On-prem LLM runtime with model weights delivered as signed offline artifacts
• Retrieval over program document stores with per-document access enforcement
• Full request/response audit logging bound to program identities
• Offline update bundle format with signature verification at import
• Operator runbooks for model rotation and evaluation inside the enclave

Architecture

• Runtime — inference, policy enforcement, and audit at the base layer
• Retrieval — document ingestion, chunking, and access-scoped RAG
• Governance — role-based access, prompt/response logging, evaluation harness
• Update — signed bundles imported through the program's transfer process

Hardware and software

• On-prem GPU servers (H200 / B200 class)
• Sovereign Runtime: orchestration, policy, audit, evaluation
• DocuFlow MCP service for retrieval
• Existing program identity provider and SIEM

Deployment environment

Air-gapped classified enclave. No outbound network path.

Results

• Analyst document review supported inside the enclave
• Complete audit trail for every model interaction
• Repeatable offline model update process

Reference architecture. Timeline and coverage figures describe the deployment pattern, not published results from a named program.