AI in Near-Airgapped Environments: When the Internet Is Optional
The Category Most AI Vendors Pretend Doesn’t Exist A surprising amount of the world’s most consequential …
A Different Compliance Frame
Most regulated industries care about commercial compliance: GDPR, HIPAA, SOC 2, PCI, DORA. Their compliance officers ask “did you keep the data safe?” Defense contractors operate under a different frame entirely. Their compliance officers ask “did you keep this information inside the right perimeter?” — where “the right perimeter” is defined by national security classifications, by contract DD-254 specifications, by CMMC compliance levels, by ITAR controls, and by sponsor-agency-specific requirements that vary by program.
For defense contractors handling Controlled Unclassified Information (CUI) and above, the architectural conversation about AI is structured differently from every other industry. There is no “EU-hosted on AWS” answer. There is no “we encrypt at rest” answer. The relevant questions are: where is the bit physically; who can touch it; what is the classification authority; what is the audit posture under inspection.
This piece is about how air-gapped AI lands in defense — where Tier 4 and Tier 5 environments are the default rather than the exception, where the regulatory frame is national-security rather than commercial-compliance, and where the architecture must satisfy not just commercial cybersecurity standards but DoD-grade authorization processes.
The Classification and Authorization Landscape
┌──────────────────────────────────────────────────────────────┐
│ │
│ US Defense classification frame (simplified) │
│ │
│ Information class Typical environment │
│ ────────────────── ───────────────────────── │
│ Public Standard internet │
│ Sensitive (FOUO/CUI) CMMC L1–L2, controlled cloud │
│ Confidential CMMC L3+; FedRAMP High; │
│ IL5/IL6; restricted networks │
│ Secret Air-gapped (SIPR); │
│ physical access controls │
│ Top Secret Fully isolated (JWICS); │
│ SCIF environments │
│ │
└──────────────────────────────────────────────────────────────┘
Most defense contractors operate across multiple classification levels simultaneously. A contractor’s IT/business systems may handle CUI. A separate part of the contractor’s facility may handle Confidential or Secret. The architectures for each are different by design, and the personnel authorized to work in each are different by clearance.
For AI to be useful inside these environments, the AI architecture has to fit the classification frame — not the other way around. A vendor that requires connectivity to a model provider’s API simply cannot operate above CUI in most contracts. A vendor that can deploy fully inside a SCIF-equivalent perimeter is the only category that meets the bar for Secret-and-above work.
What CUI-Level AI Looks Like
Most defense AI work in 2026 is at the CUI / CMMC Level 2 level rather than at Secret or higher. Contractors building, maintaining, and reporting on systems with CUI handle the largest volume of AI-amenable work: technical documentation, requirements analysis, contract drafting, regulatory reporting, code generation for unclassified systems.
┌──────────────────────────────────────────────────────────────┐
│ │
│ CUI-LEVEL AI ARCHITECTURE │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ Contractor's CMMC L2 enclave │ │
│ │ (AWS GovCloud, Azure Government, or on-prem) │ │
│ │ │ │
│ │ Calliope Workbench │ │
│ │ ── browser-accessible, enclave-internal │ │
│ │ ── identity federated through DoD-compatible IdP │ │
│ │ Astrolift Runtime │ │
│ │ ── deployed in the CMMC L2 enclave │ │
│ │ Zentinelle Policy Gateway │ │
│ │ ── CUI marking enforced; export-control │ │
│ │ evaluators │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ Inference options: │ │
│ │ - GovCloud-hosted Anthropic/OpenAI (where │ │
│ │ authorized) │ │
│ │ - Open-weights Mistral / Codestral / Llama │ │
│ │ hosted inside the enclave │ │
│ │ │ │
│ │ No outbound to commercial-cloud model providers. │ │
│ │ Audit chain in enclave-internal logging. │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
└──────────────────────────────────────────────────────────────┘
CMMC Level 2 specifically requires media-protection controls (MP family), access-control restrictions (AC family), audit accountability (AU family), and configuration management discipline (CM family) — all of which the Calliope architecture produces evidence for as a side effect of operating the platform.
The audit chain produced by Zentinelle, with cryptographic integrity and per-request structured events, satisfies the AU.L2-3.3.1 logging requirement and the AU.L2-3.3.8 audit-logging-protection requirement directly. The browser-as-bastion session model produces evidence for the AC.L2-3.1 access-control family. The BYOC runtime model satisfies media protection by keeping CUI inside the contractor’s controlled environment.
What Secret-Level AI Looks Like
Above CUI, the architecture is fully air-gapped. SIPR or equivalent network. No connection to commercial internet. Inference must be entirely local. Every action audit-trailed inside the perimeter, retained per contract-specific terms.
┌──────────────────────────────────────────────────────────────┐
│ │
│ SECRET-LEVEL AI ARCHITECTURE │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ AIR-GAPPED ENCLAVE (SIPR or equivalent) │ │
│ │ │ │
│ │ Cleared personnel only │ │
│ │ Physical access control │ │
│ │ No commercial internet connectivity │ │
│ │ │ │
│ │ Calliope Workbench (enclave-internal) │ │
│ │ Astrolift on vanilla Kubernetes │ │
│ │ Zentinelle with classification-marking evaluators │ │
│ │ │ │
│ │ Inference: Open-weights only │ │
│ │ (Mistral, Codestral, Mixtral, Llama variants │ │
│ │ that meet sponsor approval) │ │
│ │ │ │
│ │ Models staged via physical-media or │ │
│ │ classification-authorized transfer │ │
│ │ │ │
│ │ Audit chain inside the air gap; cleared │ │
│ │ personnel review │ │
│ │ │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
└──────────────────────────────────────────────────────────────┘
The architectural shape is the same as for CMMC L2 — workbench, runtime, governance, local inference — but the operational frame is stricter. Updates require classification-aware transfer procedures. Personnel access requires clearance. Audit retention follows contract-specific schedules. The platform must operate indefinitely without ever talking to a system outside the enclave.
For Top Secret / SCI environments (JWICS, SCIF-based), the architecture is the same as for Secret with additional physical and procedural controls. Calliope’s vanilla-Kubernetes provider supports these environments because it can operate fully disconnected.
The Workloads That Land in Defense
┌──────────────────────────────────────────────────────────────┐
│ │
│ Defense AI workloads in 2026 │
│ ────────────────────────── │
│ │
│ Documentation │
│ ── Technical specifications, test reports, audit │
│ responses, contract reporting │
│ │
│ Requirements analysis │
│ ── Tracing requirements through documentation, │
│ identifying coverage gaps, drafting derived │
│ requirements │
│ │
│ Logistics planning │
│ ── Supply-chain analysis, route optimization, │
│ readiness reporting │
│ │
│ Intelligence summarization │
│ ── Open-source intelligence aggregation, classified │
│ intelligence summarization (at appropriate │
│ classification levels) │
│ │
│ Code generation │
│ ── For unclassified development supporting classified │
│ systems; for cleared developers building inside the │
│ enclave │
│ │
│ Training-content generation │
│ ── Curriculum drafting, scenario development, after- │
│ action report drafting │
│ │
│ Regulatory submissions │
│ ── Sponsor-agency reporting, DD-254 management, CMMC │
│ evidence collection │
│ │
└──────────────────────────────────────────────────────────────┘
The volume is significant. The productivity ceiling is high. The architecture that makes any of this happen is the architecture that runs inside the perimeter — full stop. There is no air-gapped variant of a commercial cloud-hosted AI product. There is only the architecture designed for the perimeter from the start.
DD-254 and Export-Control Awareness
A specific compliance frame that defense contractors live with daily is the DD-254 — the Department of Defense Contract Security Classification Specification — that travels with every classified contract. The DD-254 specifies what classified information the contract involves, what security controls apply, what facility security clearance is required, what access controls govern, and so on.
For AI workloads supporting a contract with a DD-254, the governance layer must understand the contract’s classification posture. Zentinelle can be configured per-deployment with the relevant classification rules: which markings apply, which model destinations are authorized, which actions require multi-party approval, what audit retention is required, and so on.
Adjacent to DD-254 sits export control: ITAR for defense articles, EAR for dual-use technology. AI workloads that process technical data covered by these regimes have additional constraints — most importantly, the prohibition on transferring technical data to non-US-persons or to unauthorized destinations. The policy gateway enforces this by ensuring inference does not route to model providers whose operator-jurisdiction would constitute an export.
For US defense contractors using the Calliope stack, this is one of the strongest arguments for open-weights inference inside the enclave: an ITAR-covered prompt never crosses any boundary that would constitute an export, because the inference never leaves the enclave.
What the Architecture Costs (and Saves)
The capital cost of a defense-grade AI deployment is real:
- A dedicated CMMC L2 enclave (or use of a contractor’s existing one).
- GPU compute capacity for open-weights model inference inside the enclave.
- Cleared personnel time to stand up and operate the platform.
- The vendor relationship costs (Calliope subscription, forward-deployed engineering for stand-up).
The savings are also real, and they compound:
- Documentation work that used to take a senior engineer a week happens in a day.
- Requirements coverage analysis that used to be a quarterly project is continuous.
- Audit-response evidence is produced as a side effect of operating the platform.
- Regulatory reporting timelines shorten significantly.
- New developers — once cleared — onboard faster because tooling is consistent.
For a mid-sized defense contractor with multiple active programs, the ROI conversation is straightforward: the platform pays back its standup cost within the first 6–9 months on documentation and reporting efficiency alone. The other benefits compound from there.
The Question Worth Asking
For defense-contractor IT and security leadership, the diagnostic question is:
Can your current AI tooling operate at the classification levels your contracts actually require, without any external dependencies, with audit evidence acceptable to your sponsor agency?
For most off-the-shelf AI products, the answer is no — they cannot operate above CUI without dependence on a cloud-hosted service. For the open-weights-on-Astrolift architecture, the answer is yes up to and including Secret (and higher with appropriate facility controls).
This is one of the categories where the architecture is the differentiator. There is no shortcut. There is no “we can be air-gap-compatible.” The vendor either built for the perimeter or did not.
Where to Go Next
- The near-airgapped horizontal piece — the architectural argument.
- Astrolift — vanilla-Kubernetes provider for on-prem, GovCloud, and air-gapped installs.
- Zentinelle.ai — policy gateway with classification-marking and export-control evaluators.
- Mistral AI — open-weights model tier suitable for inside-the-perimeter inference.
- AI for Government and Defense: Sovereign AI Infrastructure — the broader defense pitch.
- calliope.ai/contact — for a defense-contractor architecture conversation.
Next: the same near-airgapped argument, applied to healthcare networks — where the perimeter is the hospital, the regulation is HIPAA plus its evolving cousins, and the operational urgency is measured in patient outcomes.
