Air-gapped AI deployment
Also called: disconnected AI deployment, offline AI agents
Running an AI system inside a network with no physical or logical connection to external networks, including no model API calls.
What air-gapped ai deployment means.
An air-gapped AI deployment runs entirely inside an isolated environment with no route to an external network. For agentic AI the binding constraint is that hosted model APIs are unreachable, so every model must be hosted inside the enclave, along with the orchestration layer, the policy engine, the audit store, and any tool integrations. Updates arrive by controlled physical transfer rather than over a network. Air-gapped is stricter than on-premise: software running in your own data center may still call out to a hosted model, and if it does, it is not air-gapped.
Why it matters.
Classified work, some critical infrastructure, and certain regulated environments cannot permit outbound connections at all. For those operators the question is not whether an AI platform is secure but whether it functions with no network, which most agentic tooling does not because it assumes a reachable model endpoint. Designing for this environment first means the same platform also satisfies less strict deployments.
How it works in practice.
Models run inside the enclave
Weights are hosted locally on local accelerators. Any workflow step assuming a hosted endpoint has to have an in-enclave equivalent.
The whole control plane is local
Orchestration, policy evaluation, approval workflow, observability, and the audit store all run inside the boundary, since a governance service outside it would be unreachable.
Updates by controlled transfer
New model versions and software releases arrive through a documented media transfer process rather than a package repository.
Identity from local infrastructure
Authentication binds to credentials the environment already issues, such as CAC or PIV cards, rather than an external identity provider.
What people get wrong.
That on-premise and air-gapped are interchangeable. On-premise describes where software runs; air-gapped describes what it can reach. Self-hosted software that calls a hosted model API is on-premise and connected, and the distinction is the entire point in a classified environment.
Common questions.
Can agents work without internet access?
Yes, if every dependency is inside the enclave: the models, the orchestration layer, the policy engine, and the audit store. Agents that rely on a hosted model endpoint or an external tool call cannot, which is why air-gapped capability is an architectural property rather than a configuration flag.
How are models updated in an air-gapped environment?
Through the environment's controlled media transfer process. New weights and releases are validated and moved physically, on the environment's schedule rather than a vendor's.
Is air-gapped the same as FedRAMP or an ATO?
No. Air-gapped is a deployment topology. FedRAMP authorization and an Authority to Operate are formal assessment outcomes granted by an authorizing body. Trunnion is engineered to align with NIST SP 800-53 control families; that is a design posture, not a certification claim.
Standards referenced.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- FIPS 201-3, Personal Identity Verification (PIV)
Trunnion is engineered to align with these control families. Alignment by design is not a claim of current certification or authorization.
Read next.
- Classification-aware workflowAn agent workflow that treats data classification as an enforced input to every access and action decision, not as a label.
- AI control planeThe shared layer that composes, authorizes, routes, and records agent work, separate from the applications built on top of it.
- LLM-agnostic model routingDirecting each task to an appropriate language model at runtime, so a provider can be changed without rewriting workflows.
Get started
See air-gapped ai deployment running on your workflow.
Governance, approval, and provable audit built into the control plane, from cloud to air-gap. Request a demo against a workflow you actually run.