AirGap LLMOps
Patch Tuesday for models: governed model releases in networks that have no internet.
Treat models and agents as mission software. AirGap LLMOps packages each release as a signed, versioned bundle, validates it with offline evaluation packs, gates promotion behind policy and two-person approval, and keeps checking that what is running is still what was approved. Controlled transfer in, evidence export out: no SaaS, no outbound telemetry, no online evaluation service.
Commercial LLMOps assumes a network you do not have.
Mainstream model operations tooling assumes continuous connectivity: hosted registries, SaaS evaluation services, external feeds, and centralized telemetry. Inside a high-side or air-gapped enclave, every one of those assumptions fails at once.
What fills the gap is manual work: file transfers on removable media, evaluation done once and never repeated, approvals recorded in email. Provenance becomes unclear, assurance becomes inconsistent, and the program cannot answer the question an assessor always asks: is the model running right now the model you approved?
- Model updates arriving as ad hoc file drops with no verifiable lineage
- Evaluation performed differently each cycle, and not reproducible on review
- Promotion decisions made without enforced separation of duties
- No continuous check that deployed artifacts still match approved digests
- Evidence for security review reassembled by hand after every release
A release train for models, run entirely inside the enclave.
Six stages, each producing a durable artifact and an append-only audit record. The same lifecycle (package, verify, evaluate, approve, promote, monitor) runs whether the instance sits in a government cloud or in a fully disconnected enclave fed by controlled transfer.
What makes a model release defensible.
Disconnected by default
No critical workflow requires an external call. Bundles and evaluation packs arrive through controlled transfer, keys are held in enclave-managed custody or an HSM, and evidence leaves as a file. Connected cloud integrations exist, but they are optional additions rather than dependencies.
Models governed as mission software
Every model or agent release is a signed, versioned bundle under configuration control, not a file copied into a directory. Verification happens before evaluation, and evaluation happens before promotion, in that order, every time.
Repeatable offline assurance
Evaluation packs are versioned artifacts, so the same assurance run can be reproduced later and compared across releases. Runs produce a printable Assurance Report binding the release identity to the outcomes and the people who reviewed them.
Separation of duties enforced by the platform
Publisher, Security Approver, Operator, and Auditor are distinct roles with distinct permissions. Publishers cannot approve their own promotions, and production-high promotion requires an independent approver, enforced by policy rather than convention.
Continuous answer to "is this what we approved?"
An integrity agent re-hashes deployed artifacts and critical configuration on a defined cadence and compares the result to the digest recorded at promotion. A mismatch raises an alert naming the affected environment and the last-known-good version.
Recall as a first-class operation
Rollback returns an enclave to a known-good release; recall revokes a compromised or non-compliant version and blocks further deployment. Both are recorded in the audit trail and travel with the post-incident Accreditation Pack.
Phased, so integrity lands before automation does.
Establish the release unit
Signed bundle import and offline signature verification, a version catalog per environment, and basic approvals. File-based, no integrations required.
Add repeatable assurance
Versioned offline evaluation packs and printable Assurance Reports, plus baseline gates defined for each environment.
Enforce governance
Policy-based promotion gates, signer allowlists, the two-person rule for production-high, and one-click Accreditation Pack export.
Automate integrity and extend
Scheduled drift and tamper detection, rollback and recall workflows, and optional registry, attestation, and managed-signing integrations where connectivity is permitted.
Built on guidance your reviewer already applies.
The architecture aligns to published federal guidance and to widely adopted supply chain patterns, without requiring any of the optional ecosystems. Control-family mappings ship with the Accreditation Pack so a reviewer can trace an artifact to the expectation it supports.
Responsible use.
We state the boundaries of the platform plainly, because an Authorizing Official will ask.
- Offline evaluation reduces risk but cannot prove the absence of all failure modes
- Governance artifacts support approvals; they do not replace accrediting authority judgment
- Gates, roles, release cadence, and evaluation categories must be tailored to mission requirements
- Integrity guarantees depend on protected signing keys and disciplined key custody
- Mission-specific testing and operational monitoring remain the program's responsibility
Watch a model release go through the gate.
We will run a sanitized release cycle on representative artifacts (package, verify, evaluate, approve, promote, then trigger a drift event) and hand you the resulting Accreditation Pack to inspect.