Deploying and Operating an AI Governance Proxy in an Air-Gapped On-Premises Data Center

Air-gapped governance proxy at a glance

Start by inventorying external dependencies

Because no enforcement decision should depend on an outside network, begin by identifying anything the deployment would otherwise reach for outside the data center. Each of the following needs a local equivalent:

• Identity: workload and user identity from internal directory and certificate infrastructure.
• Policy: policy stored locally on the management side of the environment.
• Audit logging: decision records written and retained locally.
• Imports: a controlled process for bringing in policies and software.

Reference architecture and trust boundaries

The reference architecture divides the environment into six zones. The proxy tier sits between the agent zone and everything the agents call.

Local identity and tool-call authorization

The proxy authenticates callers using workload and user identity from internal directory and certificate infrastructure, so no external identity provider is involved. Policy is then evaluated for each call, including whether a tool is within the agent's allowlist.

Expired or revoked certificates must be rejected. The identity test and deny test in the validation checklist below confirm this behavior.

Promoting policies and software across the air gap

Policy and software updates cross the air gap as signed bundles. They arrive in the import staging zone, an isolated area where each artifact is verified before promotion. Rollback must restore the previous behavior if a promoted bundle needs to be withdrawn.

An unsigned or altered bundle is refused. The import test below checks both the refusal and the rollback path.

Audit logging, high availability and failure modes

Redundant proxy instances authenticate callers, evaluate policy and record each decision. Decision logs are tamper-evident and forwarded to an on-premises SIEM through the log collector in the management and audit zone.

Each deployment should declare whether it fails open or fails closed when a proxy node or the log collector becomes unavailable. The failure test below confirms that the declared behavior occurs.

Validation tests before go-live and after every upgrade

• Deny test: a call to a tool outside the agent's allowlist is blocked and logged with the policy version.
• Bypass test: a direct network path from an agent to a model or tool fails.
• Identity test: an expired or revoked certificate is rejected.
• Import test: an unsigned or altered bundle is refused, and rollback restores the previous behavior.
• Audit test: decision records reach the SIEM, and a modified log segment is detectable.
• Failure test: removing a proxy node and then the log collector produces the declared fail-open or fail-closed behavior.