Network Segmentation Patterns for AI Workloads

Most government networks we meet have three layers in the PowerPoint and one VLAN in the rack. Web, app, data looked neat in 2012. An agent breaks that picture because it is a user of the data plane, a producer of new text, and sometimes a caller of tools that change state. If you drop it next to the file server 'so retrieval is fast', you have given a new, buggy, language-driven process the same reach as a file clerk with a mount.

Segmentation for AI is not a new religion. It is zones with default deny, identities that are not shared roots, and a refusal to let training, inference, ingest and officer access occupy one broadcast domain. Draw it on one page. If the page is a single box labelled SDC, you have not drawn it.

This guide offers patterns, not a vendor's fabric. Use the hall's existing firewalls first. Buy a new overlay only if the pattern cannot be expressed.

Zones that earn their keep

Zone	Lives there	Talks to
Officer access	Desktops, thin clients	Ingress only, authenticated
Ingress / API	Gateway, WAF, identity-aware proxy	App zone; never the model store directly
Orchestration	K8s API, deploy tooling	Break-glass from jump; no officer path
Generation	Model servers, GPUs	App zone; no raw NAS
Retrieval	Index, chunk store	Generation via app, not from officers
Ingest	OCR, parsers, bag admit	Source store read; retrieval write
Source / records	Authoritative files, DBs	Ingest and app, scoped
Observe	Logs, metrics, SIEM forwarder	Receives; does not sit on GPU VLAN
Build (if any)	Connected room	Nothing in run room except the bag

Four site patterns

SDC multi-tenant hall

Give each department a project: isolated VLANs or equivalent, no east-west to another department's retrieval zone. Shared inference is allowed only if prompts and chunks cannot leak in logs or caches across projects. Shared inference is how a health chunk appears in a transport agent's trace. When in doubt, do not share the model server.

District thin client

The district has no generation zone. Officers use the state WAN to hit ingress. Cache nothing that looks like a corpus on the local PC. If the WAN dies, the paper path lives. Do not invent a local replica 'for resilience' that you will not erase.

PSU plant / OT-adjacent

Two drawings. OT network remains unreachable from generation. A diode or a staged copy feeds an IT retrieval store. Jump hosts into OT stay human and ticketed. An agent with a historian login is an incident, not a feature.

Campus

Research GPUs and production agents do not share a flat science VLAN. Students do not get routes to the registrar's retrieval zone. Eduroam is not an access layer for mark stores. The computer centre already knows this for exams; apply it to the agent.

Identities are segmentation

A shared service account that can read every share will defeat every VLAN you draw once someone mounts NFS. Split ingest identity, query identity (mapped from the officer), and break-glass. Put them in different groups. Log them. Expire them. Segmentation that stops at layer 3 is how a well-drawn box still leaks at layer 7.

Objections you will hear — and what to do with them

This is too many zones for a pilot.

Then merge generation and retrieval if you must, but keep officers, ingest, source and build apart. Four zones is not a Cisco textbook. It is the minimum that survives a student intern.

The firewall team will take six weeks.

Start the ticket on day one of the bootstrap. A pilot on a flat VLAN will take six weeks to undo later. Pay the six weeks now.

Zero trust makes zones obsolete.

Zero trust is identity plus deny. Zones are how you express deny when the identity layer is an AD group from 2014. Use both. Slogans do not pass packets.

A ten-day segmentation playbook

1. Days 1–2: draw the nine zones and mark which ones you will merge, with a reason.
2. Days 3–5: implement default deny and the officer-to-ingress path only.
3. Days 6–8: open generation ↔ app ↔ retrieval. Prove ingest cannot see officer desktops.
4. Days 9–10: capture east-west. Any unexplained flow is a finding. File the drawing.

How this shows up in the file

The network annexure is a drawing with zone names that match firewall objects, plus the identity split. A vendor slide with a blue cloud labelled 'secure network' is not an annexure. When a later incident asks how the agent saw that share, the drawing should make the answer embarrassing or impossible. Aim for impossible.

Jump hosts and break-glass, not extra NICs

Admins will ask for a second NIC on the model server 'for management'. That NIC is how zones collapse. Put management through a jump host in the orchestration zone, identity-bound, recorded, and time-limited. If the hall already has a privileged-access pattern for databases, reuse it. Agents do not deserve a sloppier path than treasuries.

Break-glass should page someone, open a window, and close it. Standing jump access for an SI named in a three-year contract is not break-glass. It is a resident. Residents belong in the duty map, not in a forgotten allow rule.

• No direct SSH from the officer desktop network to generation.
• No vendor VPN concentrator inside the retrieval zone.
• BMC on an isolated management fabric, or disabled outbound at minimum.
• Packet capture on the zone boundaries during the first week, then on change.

When someone says segmentation is slowing the pilot, show them the flat-VLAN citation incident — even if it happened in another state. Speed without zones is speed toward a file you will not want to sign.

This article is a field guide, not legal, procurement, electrical or engineering advice. Confirm numbers, duties and designs against the current Gazette, CERT-In directions, your SDC / NIC / campus standards, a site survey and your counsel before you file them.

How to prove this on a rack, not on a slide

“Network Segmentation Patterns for AI Workloads” only matters if a CISO can fail it. A P4 Systems Integrator should be able to point at a cable, a registry, a licence file, a PDU reading or a SIEM index and say: this is the control. If the only evidence is a brochure that mentions “network segmentation AI”, you do not have the control.

An agent is not 'just another VM'. It retrieves, it generates, it sometimes acts. Segment it like a system that can see too much, not like a website that only serves too much. Air-gap and on-prem programmes die in the second month, when the first update, the first crash, or the first GPU lead-time slip arrives. Budget the boring path — media, offline licence, local registry, local traces — in the same note as the model name.

On-prem is not air-gapped. An India region is not either. Write the forbidden path (outbound HTTPS, licence phone-home, crash reporter, hidden model API) as a numbered list and test it with the internet off. Whatever still dies was a dependency you did not draw.

1. Draw the data path for one user-visible answer under “network segmentation AI”.
2. Disable outbound internet on staging and run the demo script.
3. List every remaining hop: update, licence, registry, NTP, DNS, SIEM.
4. Give each hop an owner inside the department, not only the SI.
5. Minute the restore or the media-transfer once before go-live.

Close this loop before the next CAB

Put “Network Segmentation Patterns for AI Workloads” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Systems Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “network segmentation AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Network Segmentation Patterns for AI Workloads” belongs in a file, not only in a search result. A P4 Systems Integrator should be able to point at one artefact that proves “network segmentation AI”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

An agent is not 'just another VM'. It retrieves, it generates, it sometimes acts. Segment it like a system that can see too much, not like a website that only serves too much. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C2 Air-Gapped & On-Prem: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “network segmentation AI”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.