PLANNING TOOLS · UNCLASSIFIED INPUT ONLY

Can we use AI
in this environment?

The question arrives as a procurement question and turns out to be an architecture question. Two free tools on this page work through it in the order the answer actually depends on: first what your data and your boundary allow, then what it would take to run AI with no cloud dependency at all. Both run entirely in your browser. Nothing is sent anywhere unless you ask for it.

Do not enter classified information or CUI. Planning-level answers only.

Check your environment Read the short answers

I.THE PROBLEM

The problem is where the data goes, not which model is best.

A team with real work to do finds a capable model, and then hits a wall that has nothing to do with capability. The data is Controlled Unclassified Information, or export controlled technical data, or simply proprietary enough that nobody wants to explain later where it went. The environment has filtered egress, or none. A contract clause reaches the data. Somewhere in the organization a person has to answer for the handling, and there is no architecture yet to point at.

/ THE SHAPE OF IT

A prompt is a transfer

The moment text goes to a service outside your boundary, it has left. Retention, access and physical location follow the provider terms rather than your handling requirements, and the transfer completed before anyone reviewed it. Everything downstream of that moment is remediation.

/ THE SHAPE OF IT

Connectivity is an assumption, not a fact

Most AI tooling assumes an internet connection the way it assumes electricity. In an enclave, on a disconnected network, or inside an accredited facility, that assumption fails quietly: a library that phones home, an update path that needs a public repository, a telemetry agent nobody looked at.

/ THE SHAPE OF IT

The evidence question arrives late

The pilot works. Then someone asks what an assessor will read: who asked what, what was retrieved, what the model returned, what action followed, and who accepted it. Evidence designed in is a log. Evidence added afterward is a project.

/ THE SHAPE OF IT

Nobody wants to be the one who decides

The data owner, the security officer, the contracting officer and the mission owner each hold a piece of the answer, and the question stalls between them. Naming which piece is missing usually moves it further than another vendor demonstration.

II.WHAT USUALLY GOES WRONG

The failures repeat, and they are predictable.

Controlled information is pasted into a commercial model by someone doing their job well and quickly, because policy was the only control in the path.
A model is selected before the boundary is settled, so the architecture is chosen twice and paid for twice.
The provider terms that were read are the public terms page, and the enterprise agreement says something different about retention.
An air-gapped pilot succeeds and then cannot be updated, because nobody designed how a new model version crosses the boundary or who authorizes it.
Retrieval is bolted onto a document store that does not enforce access rules, so a query returns something the asker could not have opened directly.
Observability comes from a library that sends telemetry outward by default, and the finding arrives from the network team rather than the vendor.
An approval step exists but is satisfied by clicking through a notification, which produces a log entry rather than an approval.
The model is asked to make an access or marking decision, which is a rule an assessor can test being replaced by a judgment nobody can.
Patching stops, because the environment has no reachable repository and no staged path was built.
The evidence request arrives from outside the team, and the answer is a screenshot.

III.WHAT YOU NEED TO KNOW

Short answers to the questions behind the question.

Can AI run in an air-gapped environment?

Yes, and the hard part is not the model. A disconnected deployment has to supply, inside the boundary, everything a connected one quietly gets from outside: accelerators and a serving stack you can restart without reaching out, model weights that arrive through an authorized transfer and are signature-verified before they run, a retrieval index built and held inside, identity and authorization that work with no external identity provider, observability with nothing phoning home, patching with no reachable repository, and an audit record an assessor can read later. Most air-gapped AI efforts stall on the transfer and update path rather than on inference.

What does CUI-safe AI architecture require?

It requires knowing exactly where CUI goes and being able to show it. In practice that means inference on infrastructure whose location and administration you can name, a written provider term that excludes retention and training on your inputs where any external service remains, logs you can read and retain yourself, retrieval that enforces the same access rules as the source documents, and an evidence trail tying each request to an identity, a retrieval set and an outcome. The handling requirements come from the CUI program at 32 CFR Part 2002 and, on defense contracts, from DFARS 252.204-7012 and NIST SP 800-171. The architecture is what makes those requirements demonstrable rather than asserted.

Why is AI governance an architecture problem as well as a policy problem?

Because a prompt is a transfer, and it completes before any policy is read. A policy that forbids pasting controlled information into a commercial model is necessary and insufficient: it is enforced by memory, at the moment a person is busy. Architecture decides what is possible. Where the model runs, what egress exists, what the retrieval layer will return to whom, and what an action can reach are all settled before anyone is asked to behave well. Policy tells people what to do. Architecture determines what happens when they do not.

When should deterministic controls override model judgment?

Whenever being wrong is expensive and being right is not verifiable at the moment of use. Access decisions, classification and marking, release outside a boundary, and any action with a physical, financial or safety effect belong to deterministic rules that a person can read and an assessor can test. A model is a good instrument for drafting, retrieval, triage and summarizing, and a poor one for deciding who may see something. The design rule is that the model may propose, and a rule outside the model decides.

What should human approval look like in sensitive automation?

A named person, a specific action, and a record. The approver sees the exact action and the evidence behind it, not a summary of a summary. The approval is bound to their identity, happens before the action takes effect rather than after, cannot be granted by the system to itself, and leaves a signed record that can be replayed later by someone who was not there. If an approval step can be satisfied by clicking through a notification, it is a log entry rather than an approval.

IV.CHECK YOUR ENVIRONMENT

Tool one: can we use AI in this environment?

Eleven questions about the data, the boundary and the consequence. The result names one or more architecture categories worth evaluating, why your answers led there, what to ask a vendor or a security officer next, and what this tool cannot decide. It does not produce a score, because a number would suggest a precision the answers do not carry.

Do not enter classified information or CUI. Planning-level answers only.

Both tools need JavaScript, and the questions do not.

Work through them on paper. Tool one asks: the most sensitive data category the use case touches (public, proprietary, CUI, export controlled); the deployment boundary; actual network connectivity; who hosts the model; where inference physically runs; who holds the logs and telemetry; whether the provider retains prompts or trains on them; whether the workflow depends on an external API; what human approval is required; what audit evidence is owed; and what happens if the model is wrong and nobody catches it. Controlled data plus provider-held infrastructure, retained prompts or a required external call points at evaluating an on-premise deployment. Disconnected or intermittent connectivity points at a disconnected architecture. Any answer you cannot settle points at a security review before an architecture is selected.

Tool two asks whether each of fourteen things exists: model hosting and GPU infrastructure, data ingestion, identity, authorization, software supply chain and signing, model updates and transfer across the boundary, removable media handling, controlled updates, patching, observability without external telemetry, audit, retrieval, human approval, and model security. Anything resting on something that is not in place is the thing to sequence first.

Or write contact@saliandefense.com with the data category, the boundary and the connectivity, at planning level, and we will walk it through with you.

Tool two: what would it take to run AI without cloud dependency?

Fourteen dimensions, each with what has to exist for a disconnected deployment to be real. Mark each one in place, not in place, or not sure. The picture below shows what rests on what, and a sensible order to work in. No costs here: the sequence is the useful part, and the numbers depend on the site.

Loading the dependency checklist …

V.WHAT SALIAN DOES

Where Salian fits, once the architecture is settled.

Architecture first. When the boundary, the data question and the evidence requirement are settled, these are the pieces Salian brings, described by what they do and who uses them.

/ PRAESIDIUM SUITE

Legatus

Controlled AI workflow orchestration with signed human approval. For mission and program teams that need a named person to accept a specific action before it takes effect, and a record of that acceptance that someone else can read later.

/ PRAESIDIUM SUITE

Vigil

Defines and evaluates the boundary policy an AI system must respect: what to allow, what to redact, what to block. For security officers and engineering teams who need the rule written where it can be tested rather than restated in a memo.

/ PRAESIDIUM SUITE

Hawk RAG

The retrieval layer shared by the Hawk products. For teams that need answers grounded in their own documents, with retrieval that respects the access rules the source material already carries.

/ ENGINEERING

Custom software and integration

Where a mission workflow needs something no product provides: ingestion into a constrained environment, transfer and update paths across a boundary, evidence pipelines, and the integration work between systems that were never designed to meet.

VI.WHAT SALIAN DOES NOT CONTROL

The decisions belong to the authorities that hold them.

Authorizing Officials authorize systems. Nothing on this page is an authorization, and no result here anticipates one.
The applicable Accrediting Official or Cognizant Security Authority accredits facilities and sets the rules for the boundary a system sits in, including media transfer.
CMMC certification rests with an authorized C3PAO or the Department of Defense.
DCSA, or the applicable Cognizant Security Agency, determines facility clearances.
Your data owner decides how a specific record is categorized and marked.
Your contracting officer reads the clause that governs the data. So should you, before an architecture is selected.

Outputs describe readiness categories and open questions. They are not accreditation, authorization, or certification decisions. Accreditation is determined by the applicable Accrediting Official or Cognizant Security Authority; CMMC certification by an authorized C3PAO or the Department of Defense; system authorization by the Authorizing Official. Do not enter classified information or CUI.

VII.WHAT HAPPENS NEXT

What happens after you run the tools.

You get the result on screen. It stays in your browser. Read it, copy it, close the tab, and nothing has left.
If you want a second read, the optional summary at the end of tool one sends your answers and the categories to Salian, and only when you press the button.
The first conversation is unclassified and costs nothing but the time to describe what you are trying to accomplish, at planning level.
If the honest answer is that you need a security review before any architecture, we will say so, and it is usually a short conversation rather than an engagement.
If the answer is an on-premise or disconnected build, the next step is a scoped look at the fourteen dimensions in tool two against your actual environment.

VIII.SOURCES

Where the regulatory references come from.

These are the authorities behind the language on this page. They are starting points for your own reading and for legal review, not a determination.

Controlled Unclassified Information program, 32 CFR Part 2002. The implementing directive for the CUI program established by Executive Order 13556, with the CUI Registry maintained by the National Archives and Records Administration. National Archives and Records Administration · archives.gov/cui · Retrieved 2026-09-02
NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. Revision 2 is the text DoD contracts pin through a class deviation; NIST published Revision 3 in May 2024 and withdrew Revision 2 at the NIST level. Check which revision your contract names. NIST · csrc.nist.gov/pubs/sp/800/171/r2/upd1/final · Retrieved 2026-09-02
DoD Cloud Computing Security Requirements Guide, Impact Level definitions. Defines the Impact Levels used to describe what data a cloud offering may hold, including the boundary between publicly releasable and controlled unclassified information. DISA and DoD CIO · public.cyber.mil/dccs · Retrieved 2026-09-02
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The clause that carries NIST SP 800-171 onto defense contracts and sets the cyber incident reporting obligation. Clause text dated May 2024 at retrieval. Department of Defense · acquisition.gov/dfars/252.204-7012 · Retrieved 2026-09-02
Export Administration Regulations (EAR), 15 CFR Parts 730 to 774. Governs dual-use technical data, including release to a foreign person. Sending technical data to a service that can be read abroad is the exposure to design against. Bureau of Industry and Security, Department of Commerce · bis.gov/regulations/ear · Retrieved 2026-09-02
International Traffic in Arms Regulations (ITAR), 22 CFR Parts 120 to 130. Governs defense articles and defense technical data, with its own rules on release to foreign persons. Directorate of Defense Trade Controls, Department of State · pmddtc.state.gov/ddtc_public · Retrieved 2026-09-02

Regulatory references above are high level and current as of the retrieval date shown. Requirements change, and the clause in your contract governs over any summary of it.

IX.TALK TO SALIAN

/ NEXT STEP

Describe the environment, not the data.

Tell us the data category, the boundary, the connectivity and what the workflow has to do. That is enough to have a useful conversation, and it requires nothing controlled. We will tell you which of the categories above fits, what we would want to see before recommending an architecture, and where the honest answer is that a security review comes first.

Discuss your project › Advisory See full capabilities