What does sovereign AI infrastructure actually require?

Three properties, verifiable rather than contractual: data never leaves the territory or the perimeter (no egress paths at the architecture level, not just in the terms of service), every identity and authorization decision is under local control (your PKI, your policies, no third-party identity plane), and the full stack is operable without internet (install, update, revoke, audit — all offline). If any of the three fails, sovereignty is a marketing claim rather than an architecture.

What is different about auditing agent actions in classified environments?

Two things: the audit trail itself is sensitive, so it must be sealed and access-controlled with the same rigor as the data it describes; and attribution must be exact, because in a classified setting 'a shared service account did it' is not an answer anyone can act on. Per-agent mTLS identity, append-only hash-chained audit, and offline verification cover both: the trail is tamper-evident, exportable, and every entry names a single agent principal.

Where should a public sector agency start with agentic AI?

With an internal, unclassified operational use case on systems already inside the perimeter: document processing, logistics, maintenance knowledge bases, inter-agency reporting. Deploy the gateway in the target network profile from day one — including fully air-gapped if that is the production constraint — so the pilot evidence is produced under the same conditions the accreditation authority will judge. Retrofitting an internet-connected pilot into an air-gapped enclave rarely survives the security review.

← All insights

Public Sector & Defense

Agentic AI in Government & Defense: Air-Gapped Deployments, Sovereign by Design

Q: Can AI agents run in an air-gapped network?

Yes — the requirements are that every component the agent stack depends on is self-contained: the mediation gateway, the policy engine, the model endpoint, the audit store, and the connectors. An MCP gateway architecture satisfies this because it is a containerized runtime with no external service dependencies: no license-server callbacks, no telemetry endpoints, no cloud control plane. Models can run on the same on-premise GPUs, including fully offline open-weights stacks.

Q: How do agents get model intelligence without cloud APIs?

Open-weights models (Llama, Mistral and similar) run on the organization's own GPUs inside the same enclave. Agent quality has reached the point where self-hosted models handle the tool-calling and reasoning patterns of enterprise agent workloads, and the gateway enforces the same mTLS identity, OPA policy and per-call audit regardless of which model sits behind it. The agent stack does not degrade when the model moves inside the perimeter — the governance layer is model-agnostic by design.

By Talentys · September 16, 2026 · 9 min read

Every government AI strategy document now contains the word "sovereignty". Few infrastructure products survive contact with what sovereignty actually demands in a ministry, an agency, or a defense network: run with no internet, no cloud dependency, and no path for data to leave the perimeter — then prove it to an accreditation authority that has seen every vendor pitch in the book. Agentic AI raises the bar again, because an agent is not a document you can file: it acts continuously, and every action needs the same guarantees. This is the deployment checklist we use when "sovereign" is an architecture requirement, not a slogan.

Three properties sovereignty actually requires

Each one is verifiable at the architecture level rather than contractual:

No egress, structurally. Not "we promise not to phone home" — there must be no phone-home to make. No license-server callbacks, no telemetry endpoints, no cloud control plane, no update mechanism that requires the open internet. In an air-gapped enclave these are not features; they are disqualifiers.
Local control of identity and authorization. Your PKI issues the certificates, your policy engine makes the allow/deny decisions, revocation works offline. A third-party identity plane — even a very reputable one — is a sovereignty leak by definition.
Full operability offline. Install, configure, update, revoke, audit: the complete operational lifecycle must run without connectivity. If any step needs a connected staging environment, the enclave's accreditation boundary just grew by one external dependency.

The self-contained agent stack

The pattern that passes accreditation reviews is a fully self-contained stack, where the MCP gateway is the keystone because it removes every external dependency from the agent layer:

Agents call tools, not networks. The gateway's 73-connector estate — REST, SQL, SAP, mainframe, Kafka, file systems — is reachable through governed MCP tools inside the enclave. Agents never need a route outside it, because nothing they need lives outside it.
Models run on enclave GPUs. Open-weights models (Llama, Mistral and peers) self-host on the organization's own hardware. Modern open models handle enterprise tool-calling reliably, and the gateway is model-agnostic: mTLS identity, OPA policy, and per-call audit apply identically whichever model sits behind it.
Zero external calls by construction. A containerized runtime with no dial-out paths. Accreditation reviewers can verify this with a network trace, not a datasheet.
Offline lifecycle. Installation from signed offline bundles, updates through the same controlled channel as the rest of the estate, certificate revocation via local CRL/OCSP responders, audit export to offline verification tools.

Audit in classified settings: two extra rules

The Zero Trust checklist from our security deep-dive applies verbatim, but classified environments add two constraints:

The trail is sensitive too. An audit log describing classified actions is itself classified. It needs the same sealing and access control as the data it describes — append-only, hash-chained, WORM-compatible, with read access scoped as tightly as the source systems.
Attribution must be exact. "A shared service account did it" is not actionable in a classified setting. Per-agent mTLS identity means every entry names one principal — the property investigators ask for first.

Behavioral baselines and automatic quarantine matter doubly here: in an enclave, anomalous agent behavior may be the first observable sign of an insider threat, and containment in minutes rather than shifts is the difference between an incident and a breach report.

Where agencies actually start

Use case	Why it fits sovereign constraints
Document & records processing	Internal corpora only; immediate hours-back value; no external data path
Logistics & maintenance knowledge agents	Operational data already enclave-resident; read-heavy, easily scoped
Inter-agency reporting automation	Structured data assembly across internal systems; auditable per call
Legacy system mediation (mainframe, archives)	Modern agents over decades-old systems without exposing them to the network edge

The deliberate omission, again: high-consequence autonomous action. In sovereign environments the sequencing rule is stricter than anywhere else — evidence before autonomy, because the accreditation authority's trust is built one verifiable deployment at a time.

The deployment rule that saves programs

The pattern we recommend to every public sector team: pilot in the production network profile from day one. If the target is an air-gapped enclave, the pilot runs air-gapped — same install bundles, same update channel, same offline revocation, same sealed audit. The evidence the accreditation authority will judge is produced under exactly the conditions it certifies. The most common failure mode we see is the reverse: an internet-connected pilot that "will be adapted later", which collapses in security review because nothing measured transfers. Sovereignty is not a retrofit; it is a starting condition.

Frequently asked questions

Can AI agents run in an air-gapped network?

Yes — provided every dependency is self-contained: gateway, policy engine, model endpoint, audit store, connectors. No license callbacks, no telemetry, no cloud control plane. Open-weights models run on enclave GPUs.

What does sovereign AI infrastructure require?

Three verifiable properties: no egress paths at the architecture level, local control of identity and authorization decisions, and a full operational lifecycle that works offline. Miss one and sovereignty is a claim, not an architecture.

How do agents get model intelligence without cloud APIs?

Self-hosted open-weights models on the organization's own GPUs handle enterprise tool-calling; the gateway enforces the same identity, policy and audit regardless of the model behind it.

What is different about auditing in classified environments?

The audit trail itself is sensitive — seal and scope it like the data it describes. And attribution must be exact: per-agent identity, not shared accounts, in every entry.

Where should an agency start?

An internal operational use case, deployed in the target network profile from day one — air-gapped if production is air-gapped. Pilot evidence must be produced under the conditions the accreditation authority certifies.

Next steps

Sovereign agent deployments are won or lost before the first model call — at the moment you choose whether the pilot environment matches the accredited one. ArcaX runs 100% on-premises, including fully air-gapped enclaves, with the per-call evidence trail accreditation reviews ask for by default.

Request a demo Start with the Zero Trust checklist