Model Serving & Sovereign AI
The strongest claim in the agent platform is that a customer can run the entire AI stack with no model vendor, no egress, and no call home, and that this is the shipped default posture, not a hardening exercise. Two mechanisms carry it: a model production pipeline where the only step that touches the network is gated, and a tier model whose safe default is AI off.
Getting a model onto a cell is two distinct capabilities, named apart because they carry different gates. The producer side is Model Provisioning, it takes raw material to a sealed, signed, servable artifact, and its defining gate is the network gate on the one step where egress is legitimate. The runtime side is Model Serving, it runs that artifact in-process, local to the cell, behind a signed-manifest admission gate that refuses an unsigned or altered artifact. This page covers the full pipeline, the hand-off between them, and the tiers.
Producing a model: one gated egress point
A provisioning pipeline takes raw material to a sealed, signed, servable artifact. The interesting property is that egress is legitimate at exactly one step, and that step is explicitly bounded.
Figure D7: the model production pipeline. Acquire is the one step where egress is legitimate, so it sits behind a network gate (amber). The artifact is signed at production (green), and before it is served it must clear a signed-manifest admission gate (green), an unsigned or altered artifact is not loaded. A net-potential-gain gate also governs the pipeline itself.
Table equivalent
| Step | What happens | Gate |
|---|---|---|
| Acquire | Fetch the raw weights from a provider source | Network gate: the one place egress is legitimate, explicitly bounded |
| Quantize / compile | Reduce and compile the model for the target runtime | None |
| Sign | Seal the artifact with a signature and manifest | Produces the manifest the admission gate later checks |
| Stage | Place the sealed artifact for delivery | None |
| Install | Install onto the target cell or device | None |
| Deploy | Ring-by-ring rollout, cohorts, or a signed offline bundle to an air-gapped site | Rides the same signed fleet-release machinery as any package |
| Serve | An in-process local runtime executes the artifact | Signed-manifest admission gate: unsigned or altered artifacts are refused |
The three tiers, and the default is off
AI is a posture, not an assumption. A deployment runs in one of three tiers, and the shipped default is the most restrictive.
Figure D8: the sovereign-AI tiers. The safe default is AI off (amber): no language models, no knowledge observers, no natural-language-to-query, no retrieval-augmented generation. Sovereign (green) permits local models only, with no vendor egress. Full adds third-party providers. Each tier is opted into deliberately; nothing escalates on its own.
Table equivalent
| Tier | What it permits | Maps to deployment posture |
|---|---|---|
| AI off (default) | No language models, no knowledge observers, no NL-to-query, no RAG | Air-gapped / most restrictive |
| Sovereign | Local models only: no third-party providers, no vendor egress | Sovereign and tactical |
| Full | Local and third-party providers | Commercial |
The mapping is deliberate: commercial → full, sovereign → sovereign, and tactical → sovereign. It is a property of the shipped configuration that the posture defaults closed and that a sovereign or tactical deployment never reaches for a vendor provider.
Two runtimes, one governed call
The same chat, tool-call, and tool-result protocol drives both runtimes. What differs is where the model runs and how far a request is allowed to travel. The edge is not a degraded client of the core; it is the deployment the product is built for.
Figure: one governed call, two runtimes. Both route through the same governance and content guards (amber) before any model runs. The core serves in-process locally and reaches a third-party provider only if the tier is Full. The edge answers first on a cheap local tier and escalates only when confidence is low, and the leaf never calls the frontier itself: it flags a partial for the conductor to decide, preserving data gravity. In tactical and air-gapped profiles frontier escalation is unreachable by construction, and the leaf answers at best-available with a low-confidence flag.
Table equivalent
| Aspect | Core (full cell) | Edge (Edge Agent) |
|---|---|---|
| Runtime | In-process local model runtime | On-device sovereign inference runtime |
| First answer | Local serving behind the admission gate | Cheap local tier answers first, confidence-gated |
| Escalation | Cost-and-placement routing over a tier ladder | Confidence-gated, and the leaf emits a partial while the conductor decides |
| Third-party reach | Secure provider, only if tier = Full, redacting before egress | Relay to the fabric under grant enforcement, unreachable by construction in tactical and air-gap |
| Governance | Same identity, policy, guards, audit | Same contract, re-derived on the device |
The edge path, a confidence-gated cascade
At the edge a request is answered by the cheapest sufficient local tier and only escalated when confidence is low, grounded in verifiable signal rather than a vote of weak voters. The escalation rate is the setpoint: a persistently high rate means the on-device default should move up a tier, and a low one means the cheap tier is under-used.
Crucially the leaf never calls the cloud frontier itself. It emits a partial flagged for escalation and the conductor decides, so data gravity is preserved. In tactical or air-gapped profiles frontier escalation is unreachable by construction, and the device answers at best-available with a low-confidence flag rather than degrading to nothing.
The same governance on both runtimes
Whichever runtime serves the call, it passes the same guards before and after the model:
- A gate that can say no at the action boundary, not a filter on a prompt. See Security governance.
- Content guards: prompt-injection defense with untrusted-content delimiting, a trust-class model, and blocked-output quarantine, with verdict parity between the two runtimes, plus classification-aware output redaction on the core serving path. See AI and model security.
- Inference-egress residency: nothing leaves the boundary until a refuse-closed check passes, on the device and the cell alike.
- One identity, one audit: an agent is a directory entity with the same clearance, grant, and audit chain as a person, on both runtimes.
Serving, and serving at the edge
An in-process local runtime executes the artifact behind the admission gate, a model resolver over on-disk artifacts, a policy gate, an inference servicer with a streaming router, and an inference audit path. Vectorisation is also local through an embedding provider, so a sovereign deployment does not quietly reach a hosted embedding API. Classification-aware output redaction runs on a read-down model on the serving path, so a response is filtered to the caller's clearance (see AI / LLM security).
At the edge, the Edge Agent carries its own sovereign inference runtime, so a disconnected device reasons locally rather than degrading to nothing. Model bundles reach it either over the signed fleet-release machinery or by a signed offline bundle to an air-gapped site, and an edge inventory lets the core know which device holds which model.
In this area
| Page | What it covers |
|---|---|
| Model operations | The ML control plane expressed as SQL: model DDL, predict and evaluate in SQL, scoring and forecasting |
| The model supply chain | SBOM, dependency scanning and source validation on the way in; a registry with scanning, quarantine, provenance, watermarking and revocation; a deployment gate before it loads |
| Training and experiments | Training sets built from catalog assets, feature groups, pluggable backends, AutoML, experiments and evaluation, and an export gate |
| Federated training | Training across data that never moves, with cell-signed updates and sample-weighted quorum aggregation |
| AI and model security | The inference path: egress residency and the content guards on prompts and completions |
Related topics
- Agent Runtime, where an inference request is placed and audited.
- Knowledge, the local embedding and semantic layer a sovereign deployment relies on.
- Platform Architecture → Core and Edge, the on-device inference runtime.
- Security → Cryptography, the signing behind the artifact manifest.