Air-gapped LLM deployment playbook

Reference material NIST SP 800-53 security controls, Google SRE Workbook, and Anthropic agent evals.

What “air-gapped” means for FDEs

In practice, this usually means one of three constraints:

• No outbound internet from runtime environments.
• Strict inbound package / artifact review gates.
• Intermittent sync windows to a less-restricted zone.

Your job is to preserve utility under those constraints, not to bypass them.

Architecture pattern (minimal viable)

1. Control zone: reviewed model/prompt/tool artifacts are built and signed.
2. Transfer channel: one-way, auditable import into the restricted network.
3. Execution zone: inference, retrieval, and tool calls run fully inside boundary.
4. Observation zone: logs/metrics exported as sanitized summaries.

Non-negotiable controls

• Signed artifacts and reproducible builds.
• Strict model/version pinning and rollback inventory.
• Prompt/template change control (treat like code releases).
• PII-aware logging with redaction-at-source.
• Least-privilege tool access and command allowlists.

Update strategy without internet

• Bundle model + tokenizer + runtime dependencies as versioned release units.
• Maintain a release manifest with hash, reviewer, and environment compatibility.
• Use staged rollout: lab enclave → pilot operators → production units.

Evals before each import

Don’t import a model update into a restricted environment without a local eval gate:

• Groundedness / citation correctness on customer-like data.
• Task success on mission-critical workflows.
• Latency and resource envelope under expected concurrency.
• Safety checks for policy-violating instructions.

Operational runbook (Day-2)

• Model regression incident flow and rollback trigger.
• Prompt rollback + feature-flag map.
• Capacity burn dashboard (GPU/CPU/memory).
• Quarterly “restore from scratch” exercise.