Agents on an air-gapped site

Some sites do not have an outside connection and do not want one. A plant segment, a records vault, a desk that handles material the site has decided must never leave. These sites have usually been told that agents are a cloud thing. On Czar they are an appliance thing, and the appliance does not care whether the building is connected.

What air-gapped means here

An air-gapped Czar has no network path out of the building. It sits in the customer's rack, on a segment the site has isolated, reachable only from inside that segment. Nothing on the appliance phones home. Nothing is fetched at run time from somewhere else. What leaves the building: nothing, and on an air-gapped site that is enforced by the absence of a path, not by a policy that trusts the software to behave.

The agent layer was built for this posture rather than adapted to it. Every capability an agent uses is served by Substrate on the appliance: inference, retrieval over the site's documents, memory, adaptation, evaluation, and the integrity verification that Watchman performs. None of them reach outside.

The run, entirely on the rack

When a packet arrives through the desk's own intake, the agent reads it on the appliance. The passages it draws on come from the corpus the customer placed on the appliance or on a system inside the segment. The draft is produced on the appliance. The step that would send, spend, or change a record waits on the appliance for a reviewer who is also inside the segment. The allowed call, if there is one, goes to a system inside the segment.

The run record is written to the appliance and stays there. A reviewer can follow the run while it happens or open it the next morning. An auditor who is permitted onto the segment can read it without any part of the trail having left.

Tools inside the boundary

Tools on an air-gapped site are declared routes to on-premise systems, carried by Local Bridge. The admin decides which systems inside the segment are available as tools. A version names the ones it uses. The agent cannot reach anything else, and since there is no path out, there is nothing else to reach.

This is where the air-gapped posture is simplest to reason about. On a connected site the admin's decisions draw the boundary. On an air-gapped site the network draws it as well, and the two boundaries agree. An auditor checking what an agent could have reached has two independent answers that match: the admin's recorded list of tools and the segment's own isolation.

Designing and publishing without a connection

Agency Studio runs on the appliance. An operator draws the agent on the isolated network, a developer keeps the same agent as a file in a repository inside the segment, and publishing freezes the design into a version in the same place. Deploying points the stable address at that version. The customer's own applications inside the segment call that address.

None of this requires the site to open a window to the outside. When a version turns out to be wrong, the operator points the address back at an earlier published version, and that earlier version is already on the appliance.

One estate, more than one posture

A customer rarely has a single kind of site. The plant may be fully sovereign while the finance desk runs connected to systems it already secures. Both run Czar, and both run the same agent layer. The difference is set per appliance: which systems are reachable, and whether a path exists at all.

Agents designed for one posture do not have to be redesigned for another, as long as the tools they name are available where they are deployed. A version that names only systems inside a segment runs the same on an air-gapped appliance as on a connected one. For how the record travels within an estate, see /governance. For the platform underneath, see /platform.