Controlled data boundary
Draw the boundary first. Sensitive data stays inside the trust zone during prompting, retrieval, inference, and logging. The documented data-flow map is the primary artifact and the first thing a reviewer reads.
Capability brief · Configurable solution · Reference architecture, not past performance
Private AI & Secure LLM Deployment.
An LLM, retrieval, inference, and evaluation stack that runs where the data is allowed to be, under identity the agency already manages, with an audit trail that reconstructs any interaction.
- Offer
- Private AI & Secure LLM Deployment; commercially, Private AI Stack & Managed Ops
- Delivery model
- Configurable solution; build after award for larger programs
- Audience
- CTO/CDO, program managers, ISSO/ISSM, and platform leads at agencies and primes that must run LLM, retrieval, and inference on sensitive or controlled data; regulated commercial buyers evaluating a customer-deployed architecture
- Claim classification
- Proposed / reference capability. No separately verified past performance is claimed.
- Provenance and release rights
- Internal DSE authorship. Reference architecture reused from our own private AI reference architecture. Pursuit notes read for MLOps, registry, and edge-inference solution shape only. No customer or solicitation-restricted material reused.
Brief status: Version 0.1 · 2026-09-05 · reviewed for claim safety
The problem the buyer has
A private deployment that is private only in name.
A mission team wants a language model over its own documents, records, or sensor output. The data is sensitive, controlled, or simply not permitted to leave the environment. A shared AI service is off the table, and a pilot on a developer's laptop cannot pass a security review. The team needs an LLM, retrieval, inference, and evaluation stack that runs where the data is allowed to be, under identity the agency already manages, with an audit trail that reconstructs any interaction.
The failure mode is well known: a private deployment that is private only in name. A wrapper in front of a public API, a vector index with no access control, model weights pulled from an unverified source, tools the model can call with no provenance check, and logs that record everything except what the model saw.
Reference architecture, not past performance
The mental model we bring to a private AI engagement.
The architecture below is the mental model we bring to a private AI engagement. It is vendor-neutral, drawn from our own reference architecture, and it describes a defensible target pattern. It is not a certified design and not a description of an awarded contract.
Hosting options, chosen by the mission
Inside an agency-authorized cloud enclave the agency already operates; on-premises; or a disconnected edge node where the workload runs at the sensor. Each option keeps inference network-segmented from public model APIs and the open internet.
A note on residency language
Statements such as "your data never leaves your boundary" apply only when the architecture is deployed inside the customer's own accounts or facilities. That is the customer-deployed architecture this brief describes. We do not make that statement about any DSE-hosted or shared service, and shared product tiers are a separate offer with separate claims.
Identity and access
SSO with role- and attribute-based control enforcing least privilege on endpoints, indexes, artifact stores, and admin functions. Identity is the agency's, not ours.
Policy and inspection edge
An AI gateway for authorization and rate limiting; prompt-injection guardrails on input; inspection of output for regulated-data patterns. Model output is treated as untrusted.
Isolated inference and model provenance
Open-weight model families as the default, with a provenance manifest for weights and dependencies, integrity verification in an access-controlled registry, and a change-control record for every model, prompt, and retrieval configuration change. We do not train foundation models from scratch; we acquire approved base models and create governed variants.
Retrieval governance
Source data classified, sensitive fields redacted, and document-level access control so a user retrieves only what they are authorized to see.
Tool and agent supply chain
Any tool the model can invoke passes a provenance and integrity gate. This is the layer most assessments skip and the one our open-source mcp-warden was built for.
Audit, monitoring, and evaluation
Attributable logs of prompts, retrieved context, outputs, and access events; drift and quality monitoring alerting a named owner; a defined evaluation profile with adversarial cases, rerun after every change.
MLOps for the disconnected case
Where the mission needs models at the edge, the same pattern extends to a training and packaging pipeline with experiment tracking, a versioned registry, optimization for constrained hardware, and containerized inference with a rollback path.
What DSE delivers
Scope, artifacts, and timeline band.
Scope. One use case, one model family, retrieval over one corpus, deployed in the customer's environment. Larger programs are sequenced or delivered as build-after-award.
Artifacts. Architecture package (data-flow map, boundary diagram, control map to the frameworks the buyer names); a working pilot deployment in the customer environment; evaluation profile and results; runbooks and a handoff package the operator can maintain; optional managed operations under a separate agreement.
Timeline band. Architecture brief: three to five weeks. Pilot deployment: eight to fourteen weeks after the architecture is accepted. Fixed scope and a written fee after a scoping call.
How we work. The people who design the architecture build the pilot. Nothing is hidden in a vendor console; the buyer's engineers can rerun every test.
Evidence standard
What the buyer can inspect.
- The full reference architecture and per-layer control mapping, available before commitment.
- An illustrative sample blueprint on multi-tenant isolation and retrieval security, available on request.
- Public capability: mcp-warden and conclave on GitHub, readable and runnable.
- During the pilot: the provenance manifest, the evaluation transcripts, the access-control test set, and the audit-log reconstruction of a chosen interaction.
- Every control in the architecture package is tied to an artifact the buyer holds after handoff.
Limits and what this is not
The boundaries of this offer.
- We do not certify, accredit, or authorize systems. This work does not produce an Authority to Operate, and framework references describe alignment, not a compliance state.
- We state that a model was tested against a defined profile. We do not state that it is universally safe or compliant.
- We do not train foundation models from scratch.
- Residency claims apply to customer-deployed architecture only, as stated above.
- Unclassified work only; we hold no security clearances.
- No past performance is claimed for this offer. Pursuit material demonstrates solution design, not awarded work.
- Assessments and evaluations are time-boxed and sampling-based and carry no warranty that all weaknesses are found.
Next step
A language model over data that cannot leave its boundary.
If a mission needs a language model over data that cannot leave its boundary, request a secure AI architecture conversation. We will return a written scope for the architecture brief after one call.