What Air-gapped means in practice
Air-gapped means literally no connection between the deployment and the public internet. In practice this is enforced by Kubernetes NetworkPolicy or equivalent firewall rules at the cluster namespace level, plus a deployment process that pre-stages every binary, image, and model weight on internal storage before isolation. Air-gapped deployments are the regulatory default for defence and national-security workloads, and increasingly common for tier-1 banks in jurisdictions where the regulator treats LLM inference on customer data as a data-export event. The operational tradeoff is updates: model and software upgrades require a deliberate sneakernet-style review and import process, not a continuous CI/CD pipeline.
Related terms
Sovereign AI →
An architecture where customer data never leaves the network perimeter, model weights run on customer-controlled hardware, inference logs stay in the customer's SIEM, and the entire stack can operate air-gapped.
On-premise AI →
Deployment of AI workloads — model serving, embeddings, RAG, fine-tuning — entirely on hardware physically located in customer facilities.
Egress control →
Network policies that block outbound traffic from a deployment so no component can call external services, even by accident or compromise.
More in this category
All 62 terms, in plain language
Sovereign AI, RAG, agentic AI, IDP, MLOps and the regulations that shape enterprise AI.