The architecture of governed private AI
The interesting engineering is everything around the model: how knowledge gets in, how answers get out, how the system improves without leaking, and how any of it can be proven later.
The shape: an appliance, not a service
The platform ships as a hardened container package installed on customer infrastructure — from a laptop-class host for pilots to Kubernetes for enterprise rollout, including fully air-gapped sites. The web portal, API, model runtime, vector stores and audit chain all live inside the customer boundary. There is no vendor cloud, no account, no telemetry.
The governed knowledge lifecycle
- Ingest — documents arrive from read-only sources: SOP repositories, ticket exports, uploads.
- Classify — deterministic detectors find secrets and sensitive identifiers; critical secrets block the document entirely.
- Redact — identifiers are masked; only redacted text is ever chunked or embedded.
- Package — content becomes a versioned knowledge pack carrying provenance, permissions and risk metadata.
- Approve — a human approves the pack before anything becomes answerable.
- Serve — retrieval enforces role-based permissions inside the query.
- Monitor — unanswerable questions surface as knowledge gaps routed to review.
- Supersede or roll back — new versions retire old ones cleanly; any activation can revert.
The model layer
A model-adapter layer keeps the platform model-neutral: open-weight local models by default, or a customer-provided endpoint. Models, embedding models, retrieval configurations and prompt policies are governed components — evaluated against versioned golden sets before activation, re-evaluated after changes, rolled back on regression.
Policy and approval
Role-based access is enforced in retrieval queries. Output is advisory only, labelled with confidence and risk indicators, and refuses dangerous requests or questions the approved knowledge cannot support. Human approval gates cover knowledge activation, model changes and go-live decisions — all fail-closed.
Evidence
An append-only, hash-chained audit trail records questions, answers, sources, approvals and administrative actions. Every answer carries citations and the knowledge version used. Evidence exports serve security review, internal audit and renewal decisions.
The full architecture — data flow, threat model, key management, connector design, known limitations and customer responsibilities — is documented in the security architecture pack.