Licence Servers Break Air Gaps. Here's the Fix

Air-gap claims die more often on entitlement than on CUDA. The inference container is happy. The node is dark. Then a sidecar wakes up, cannot reach a vendor domain, and the whole deployment becomes a brick — or worse, quietly degrades: no new project, no new user, no new model mount. The brochure still says air-gapped. The log says 403.

Licence servers, cloud entitlement APIs, NGC-style portals, Helm operators that validate a key, feature-flag SaaS, and 'phone home once a month' clauses are all the same object: a control plane you do not own. If the run path needs that plane, you are not disconnected. You are on a leash.

This teardown is how SIs find the leash and replace it with a file they hold. It is not legal advice on software licences. It is operational advice on not letting a token become an outage.

Where the leash hides

Mechanism	How it looks in a demo	How it looks on day 40
Classic vendor daemon (FlexLM-style)	A server on the LAN	Daemon dies; all seats vanish
Cloud entitlement API	A key in an env var	Key refresh fails; features lock
Portal login (NGC, registries, model hubs)	Done once on the laptop	Next pull or driver needs a token
Operator / webhook validation	Cluster installs clean	Reconcile loop starts failing
Feature-flag SaaS	UI looks modern	Flags expire; fallback path dies
Time-bomb licence file	Works offline today	Clock skew or expiry halts jobs
Support 'phone home to activate'	TAM does it for you	TAM is on leave; you are dark

Hunt them with the same tools you use for telemetry: staging proxy, outbound deny, DNS logs, strings on the binaries, and a week of soak. Ask the vendor for a network manifesto. Then believe the capture.

The only patterns that work

1. No runtime check. Licence is a paper contract. Software does not phone anyone. Rarest, cleanest.
2. Signed licence file you hold, verified locally, with a documented grace period and a calendar reminder 45 days out.
3. Enclave-local licence service you snapshot and understand, with no outbound and with dual-control admin.
4. Build-room activation, then a sealed runtime that cannot call home even if it wants to — proved by deny-all.

Everything else is a hybrid you have not drawn. A 'cached token for 30 days' is a 30-day air gap. Write that sentence in the note if you accept it. Do not write air-gapped and then accept a 30-day token.

Fail open or fail closed — write it

When a licence check fails, should inference continue? For a plant-safety assistant, maybe you fail closed. For a citizen FAQ on a public circular, failing closed because a vendor token expired is an own goal. The product default is usually whatever protects the vendor's revenue. Override it in writing.

Procurement levers

• Make offline entitlement an eligibility row, not a scored extra.
• Require a network manifesto and a deny-all soak of at least seven days in staging.
• Require expiry behaviour in writing: date, grace, who is notified, whether inference continues.
• Ban licence checks on the request path. A citizen should not wait on a vendor DNS lookup.
• On exit, require a 90-day tail that does not need the vendor's cloud to keep running while you migrate.

Objections you will hear — and what to do with them

We have to fight piracy.

Then use a file or a local daemon. Fighting piracy with a cloud API on a government air gap fights the air gap harder than it fights pirates.

Everyone in the industry does it this way.

Everyone in the industry sells connected software. You are buying a disconnected duty. The industry will move if the RFP does.

The token is encrypted, so it is safe.

Encryption does not make a hop disappear. Safe malware callbacks are still callbacks. We care about the route, not the cipher.

A two-week leash hunt

1. Days 1–3: strings, docs, and a vendor manifesto. List every domain.
2. Days 4–8: deny outbound. Install, run, restart, wait. Capture every SYN.
3. Days 9–11: advance the clock; expire a staging key; kill DNS. Write fail-open/closed.
4. Days 12–14: either accept a file/local daemon in the BoQ, or mark the product ineligible for this enclave.

How this shows up in the file

Attach the manifesto, the soak capture, and the expiry clause. If those three pages are missing, you have bought a subscription that can be revoked from another continent. That is a sovereignty fact, not a feeling.

A network manifesto template you can attach to the RFP

Ask every bidder to fill this table. Empty cells are findings. 'Industry standard' is not a destination.

Event	Destinations (FQDN/IP)	What fails if blocked	Offline substitute
Install
Runtime inference
Licence / entitlement
Feature flags
Image / chart pull
Crash / metrics
Support / remote
Time / CRL / updates

Then run the soak and compare. Destinations that appear in the capture but not in the manifesto are automatic fails. Destinations that appear in the manifesto but were described as unused are conditions: delete the code or accept the hop.

Put expiry and grace in the same annexure. A licence that ends on 31 March without a 45-day internal alarm will end during year-close, which is when nobody can convene a CAB.

This article is a field guide, not legal, procurement, electrical or engineering advice. Confirm numbers, duties and designs against the current Gazette, CERT-In directions, your SDC / NIC / campus standards, a site survey and your counsel before you file them.

How to prove this on a rack, not on a slide

“Licence Servers Break Air Gaps. Here's the Fix” only matters if a CISO can fail it. A P4 Systems Integrator should be able to point at a cable, a registry, a licence file, a PDU reading or a SIEM index and say: this is the control. If the only evidence is a brochure that mentions “offline licensing air gap”, you do not have the control.

The model is local. The licence is not. That is how a disconnected stack dies on a Tuesday when a token expires. Treat entitlement as a control plane or admit you are online. Air-gap and on-prem programmes die in the second month, when the first update, the first crash, or the first GPU lead-time slip arrives. Budget the boring path — media, offline licence, local registry, local traces — in the same note as the model name.

On-prem is not air-gapped. An India region is not either. Write the forbidden path (outbound HTTPS, licence phone-home, crash reporter, hidden model API) as a numbered list and test it with the internet off. Whatever still dies was a dependency you did not draw.

1. Draw the data path for one user-visible answer under “offline licensing air gap”.
2. Disable outbound internet on staging and run the demo script.
3. List every remaining hop: update, licence, registry, NTP, DNS, SIEM.
4. Give each hop an owner inside the department, not only the SI.
5. Minute the restore or the media-transfer once before go-live.

Close this loop before the next CAB

Put “Licence Servers Break Air Gaps. Here's the Fix” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Systems Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “offline licensing air gap” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Licence Servers Break Air Gaps. Here's the Fix” belongs in a file, not only in a search result. A P4 Systems Integrator should be able to point at one artefact that proves “offline licensing air gap”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

The model is local. The licence is not. That is how a disconnected stack dies on a Tuesday when a token expires. Treat entitlement as a control plane or admit you are online. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C2 Air-Gapped & On-Prem: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “offline licensing air gap”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.