Sovereign Control Plane
A regulated public-sector entity deployed its AI governance and observability stack entirely on-premises, with zero dependency on external cloud infrastructure and zero data crossing the perimeter.
The challenge
The agency's mandate — safeguarding voter-roll and citizen-record data — ruled out any managed cloud service by policy, but its AI governance requirements (model registry, decision logging, human-oversight tracking) were the same ones a commercial deployment would need. That put the agency in a bind:
- Commercial AI governance and observability tooling assumed a cloud-hosted control plane by default
- No managed logging or model-monitoring service could touch citizen or voter-roll data under agency policy
- Existing on-prem model deployments had no centralized registry, oversight logging, or audit tooling at all
- Air-gapped network segments made standard SaaS-style telemetry pipelines unusable outright
- Every prior attempt to bolt on governance tooling had been rejected at security review for calling out to an external endpoint
The agency's security review had rejected three prior governance-tooling proposals in as many years, each for requiring some form of external network egress.
How it works
The same control plane, none of the egress
The platform's architecture — registry, policy engine, observability, logging — was re-deployed as a fully self-hosted stack inside the agency's own data centers:
- 01
All control-plane components (registry, policy engine, observability pipeline, audit log store) containerized for air-gapped deployment
- 02
Self-hosted model serving substituted for any component that would otherwise call an external API
- 03
Deployment mirrored across six sovereign data centers for redundancy, with no cross-boundary traffic between them and any external network
- 04
A network audit run continuously to verify zero egress from the control plane's network segment
- 05
Identity and access management integrated with the agency's existing sovereign directory service, not an external identity provider
- 06
Model and agent registry populated with every existing on-prem deployment, most of which had never been centrally logged before
- 07
Independent third-party penetration test and network-egress audit completed before go-live
What we built
Key capabilities
Fully self-hosted
Every control-plane component — registry, policy engine, observability, logging — runs inside the agency's own infrastructure.
Zero external egress
Continuous network auditing verifies no traffic leaves the controlled perimeter, not just at go-live but on an ongoing basis.
Sovereign identity integration
Access control runs through the agency's own directory service rather than an external identity provider.
Redundant without external dependency
The platform runs across six data centers for resilience, with no reliance on any cloud region or external network.
Before vs after
What changed in the deployment model
- Governance tooling location
- Rejected (required cloud) → fully on-prem
- Centrally logged deployments
- 0 → all on-prem models and agents
- External network egress
- N/A → 0, continuously audited
- Data centers under governed platform
- 0 → 6
Business impact
What it changed
Zero data left the perimeter
A continuous network-egress audit and an independent penetration test both confirmed no citizen or voter-roll data crossed the controlled boundary at any point during or after deployment.
Three years of rejected proposals resolved in one deployment
The agency's security review had turned down three prior governance-tooling attempts for requiring external calls; the self-hosted architecture cleared review on its first submission.
Every on-prem model brought under governance
Deployments that had never been centrally logged now report into a single sovereign registry across all six data centers.
Technology stack
“Sovereignty isn't a deployment option you toggle on a cloud console — it's an architecture decision made before the first line of infrastructure is provisioned. This one was built to never need an exception.”
Keep reading