Air-gapped AI agents
How do you run AI agents fully on-premise or air-gapped?
To run AI agents fully on-premise or air-gapped, every part an agent touches at run time must sit inside your boundary: the models, the gateway, the knowledge store, the tools, the guardrails and the logs. Nothing may call an outside service, and updates must arrive as files you carry in.
On-premise and air-gapped are not the same
| Mode | What it means | Outside connection |
|---|---|---|
| On-premise | The system runs in facilities you control | May exist, for updates or licence checks |
| Air-gapped | The system runs with no network path to the outside | None. Everything arrives on approved media |
A system can be on-premise and still depend on an outside service. The test for air-gapped is simple: pull the cable and see what stops working.
What has to be inside, in order
- Models. Open-weight language, embedding and speech models, served on your own GPUs. A hosted model API fails the test.
- Model serving. The software that loads models onto GPUs and answers requests.
- The gateway. Access, budgets and logging for every model call.
- Knowledge. Document ingestion, the vector store and retrieval, with your permissions applied.
- Tools. Every system an agent can call must be reachable inside the boundary.
- Guardrails and evaluation. Checks on inputs and outputs, and test sets, all run locally.
- Identity. Sign-in against your own directory.
- Logs and traces. Stored inside, so you can show how each answer was produced.
- Updates. Software and model updates delivered as signed files, installed by your own staff.
Where projects fail the test
- A licence check that calls home.
- An embedding or reranking model that is still a hosted API.
- Telemetry sent to the vendor by default.
- Container images pulled from a public registry at start-up.
- A guardrail or moderation service that runs in a cloud you do not control.
- An agent tool, such as web search, that assumes internet access.
How to prove it
Install the system in a network with no outside route. Run a complete agent task: a question that needs retrieval, a tool call and a guardrail check. Then inspect the network logs for any attempted outside connection. Repeat after an update.
Where Katonic fits
The Katonic platform can run with no outside connection. Models are open-weight and served on your own GPUs. The gateway, knowledge, agents, guardrails, evaluation and audit all run inside the boundary, and every model call is logged there. Air-gapped transcription for public-safety agencies is one of the use cases built this way.
Read next
- Sovereign deployment →
- Air-gapped AI, explained →
- Use case: air-gapped interview transcription →
- The Sovereignty Test →
Questions and answers
Can AI agents run with no internet connection?
Yes, if the models are open-weight and served locally, and every other part the agent uses at run time is installed inside the boundary.
Which models can be used air-gapped?
Open-weight models whose licence allows local use, served on your own GPUs. Models offered only as a hosted API cannot be used.
How are updates applied to an air-gapped system?
As signed files brought in on approved media and installed by your own staff.
Is on-premise the same as sovereign?
No. On-premise says where the system runs. Sovereignty also depends on who governs it, who operates it, who holds the keys and who can switch it off.
Does air-gapped mean lower quality answers?
It limits you to models you can host. For many enterprise tasks, open-weight models grounded in your own documents perform well. Test with your own questions before deciding.