The Sovereign AI Stack, Layer by Layer

CIOs do not buy sovereignty. They buy a stack they can defend in a PAC meeting. Here is the stack we walk through with every ministry, PSU and campus that asks Prcept AI to deploy. If a layer is missing, the cover note is false, even if the model is impressive.

Read this as an architecture review script, not as a product tour. For each layer we give the question the CISO should ask, the artefact that answers it, and the failure we keep seeing.

Layer 0 — Facility and network

The agent has to live somewhere a physical security officer already understands. Typical Indian public options are a departmental rack, a State Data Centre, NIC cloud, or a private cloud the institution already operates. [Air-gap](/blog/air-gapped-vs-on-prem-vs-sovereign-cloud)ped is a special case of this layer: no route to the public internet, including for model updates, licence checks and crash-reporting.

If the only path to the model is a public HTTPS call, you do not have a facility layer. You have a SaaS subscription. SaaS can be a legitimate choice. It is a different object. Do not let the bid treat them as interchangeable.

Ask: which building, which VLAN, which firewall owner, which change ticket opens a new route. The artefact is a signed network diagram plus an egress allow-list. The failure is a slide that says deployed in India.

Layer 1 — Identity and keys

Who can start an agent, who can approve a tool call, and who holds the encryption keys. Keys that live in a vendor-managed HSM in another country are not your keys. Identity that federates to a foreign IdP creates a quiet export of employee identifiers every time someone logs in.

Privilege is the other half. A standing vendor engineer account that is used for support is a foreign admin path, even if the disks are local. Time-bound, ticketed, recorded access is the minimum. If the vendor cannot operate without a permanent god user, they cannot operate inside your perimeter.

Ask: show the key ceremony, the rotation runbook, and the export of privileged users from last month. The failure is we can rotate keys if you raise a ticket.

Layer 2 — Models

Open-weight models on your GPUs, an approved Indian host, or a listed external provider the contract can name and kill. Model-agnostic is not a slogan. It is the right to change Layer 2 without rebuilding Layers 3 to 6.

Fine-tunes and adapters belong in your object store, not in the vendor's shared catalogue. Licence servers that phone home are a cut-off risk. Silent fallbacks to a hosted large model are a transfer you did not approve. All three belong in the statement of work as named prohibitions.

Ask: name every model in the default path and every model in any fallback path. Disable outbound internet on staging and watch what dies. Whatever dies was Layer 2 pretending to be local.

Layer 3 — Data plane

This is where most diagrams lie. The data plane is not only the production database. It is the retrieval index, the embedding store, the prompt cache, the scratchpad the agent writes while it plans, and the evaluation set the vendor used last Tuesday.

• System of record: file, ERP, LMS, grievance or HR database.
• Retrieval: chunk store and vector index.
• Working memory: plan traces and tool results.
• Human review: screenshots, redlines, voice notes.
• Evaluation: gold answers built from real tickets.

Each of those stores can hold personal data. Each needs a retention clock and an erasure method. Deleting the PDF and leaving the vector is not erasure. Deleting production and leaving the eval set is how the next customer inherits your citizens.

Layer 4 — Tools the agent may call

An agent that cannot act is a chatbot. An agent that can act without a permission map is a breach. Each tool needs a scope, a data class, an approval rule and a log field. Writing a noting in eOffice is not the same privilege as pushing a payment file.

Tool use is also how purpose creeps. A scholarship agent that suddenly gets a tool to read hostel CCTV transcripts has changed purpose. That is a new instruction, not a clever release. Bind tools to purpose tags. New tools inherit the parent purpose or they do not ship.

Layer 5 — Observability without egress

You still need traces. You do not need a foreign APM tenant. CERT-In already expects time-synchronised logs retained in India. Build the dashboard on the same side of the firewall as the agent.

If a vendor's only debug path is send us the trace, you have re-created telemetry under another name. If their installer opens an outbound connection to a crash service, Layer 0 was a lie. Debug is part of the system. Treat it as a production data store.

Ask for a week of traces opened in your SIEM, not in their portal. If they cannot export, they cannot be audited.

Layer 6 — Governance and the human gate

Role-based access, purpose tags, retention clocks and a human checkpoint on any action that spends money, changes a citizen record, or leaves the department. This layer is what a DPO can audit. Without it, Layers 0 to 5 are a very expensive science project.

Governance is also how you survive May 2027. When operational DPDP duties commence, you will need to show purpose, basis, processor instructions and an erasure path. Those are Layer 6 artefacts. They are cheaper to design now than to retrofit onto a running agent that has already embedded two years of tickets.

A one-page review agenda

Give this agenda to the vendor a week before the architecture review. Two hours is enough if they bring artefacts. Two days is not enough if they bring slides.

1. Layer 0: network diagram, egress allow-list, update path.
2. Layer 1: key ceremony, privileged-user export, support access tickets.
3. Layer 2: model list, fallback list, licence-check behaviour with internet off.
4. Layer 3: inventory of indexes, caches, eval sets, retention.
5. Layer 4: tool catalogue with purpose tags and approval rules.
6. Layer 5: SIEM export of a real trace, time sync, CERT-In retention.
7. Layer 6: role map, DPA draft, exit schedule, deletion certificate template.

How the layers fail together

A stack is only as sovereign as its weakest layer, and the weak layer is usually the one the demo never shows. A beautiful local model (Layer 2) with a foreign APM (Layer 5) is a transfer. A locked facility (Layer 0) with a standing vendor admin (Layer 1) is a foreign control path. A perfect tool catalogue (Layer 4) with no purpose tag (Layer 6) will grow a new purpose the week after go-live.

Review the layers as a chain, not as a buffet. Vendors like buffets because they can score well on the items they sell. You need the chain because an incident will walk the chain.

A worked walk of a single ticket

A citizen files a grievance. The ticket lands in the system of record (Layer 3). The agent embeds it (still Layer 3). It calls a retrieval tool (Layer 4). It asks a local model to draft (Layer 2). A supervisor approves (Layer 6). The trace is written to the SIEM (Layer 5). Keys wrapped the stores (Layer 1). The whole path stayed inside the SDC (Layer 0).

Now change one hop. The draft step times out and retries against a hosted model. The ticket text, the retrieved chunks and the officer's identity just left the chain. The other six layers being perfect does not save that hop. That is why the teardown is seven layers, not one slogan.

Staffing the stack

A sovereign stack that only the vendor can operate is a subscription with extra steps. Name the internal owner for each layer. Facility is usually the SDC or NIC lead. Keys are CISO. Models are the AI lead. Data plane is the application owner. Tools are the process owner. Observability is SOC. Governance is DPO. If a name is missing, that layer will rot.

Training is part of the stack. Officers who cannot read a trace will not know when a layer has failed. Budget two days of hands-on for the people who will be on the bridge at 11pm, not only a seminar for the people who signed the note.

Stand up the seven layers without boiling the ocean

You do not need a perfect stack on day one. You need a stack whose missing layers are named. Start with Layer 0 and Layer 5, because they are the usual lies: a facility claim and a telemetry claim. If those two are true, you can add models and tools without smuggling a transfer.

Days 1–10: freeze the network story. Named hall or VLAN. Egress allow-list. Update path. Licence-check behaviour with the internet off. If the runtime dies without the internet, Layer 0 is incomplete. Fix that before you invite users.

Days 11–20: put traces in your SIEM. Not their portal. A week of real traces, time-synchronised, retained in India. If the vendor cannot export, stop. You will not audit what you cannot hold.

Days 21–35: tool catalogue and purpose tags. Every tool gets a scope, a data class, an approval rule and a log field. New tools do not ship without a dated instruction. This is Layer 4 plus Layer 6. It is also how you stop the helpful SI from inventing purpose.

Days 36–45: model path and keys. Name default and fallback. Hold or control the keys. Rehearse a model swap. If a swap requires a commercial negotiation, you do not have Layer 2. You have a subscription.

• Name an owner for every layer before go-live.
• Train the night-bridge people, not only the signatories.
• Re-walk one live ticket through all seven layers after the first week of production.
• Any hop that left the chain is a priority-one defect, not a backlog item.

Objections you will hear — and what to do with them

Vendors will want to start at Layer 2 because models are what they sell. Start at Layer 0 and Layer 5 anyway. Models are easy to swap if the facility and the logs are true. They are expensive to swap if you discover the facility was a slide.

SDC teams will say they cannot support GPUs. Then you do not have Layer 0 for this workload yet. Fund the hall or reduce the use case. Do not pretend a hosted GPU is the same hall.

CISOs will focus only on keys and ignore tools. Keys without a tool allow-list will still leak through a helpful email-the-citizen action. Bring them to Layer 4.

Someone will say seven layers is too many for a pilot. Pilots that skip layers become productions that skipped layers. Name the skipped layer and the date it will exist. Unnamed skips are permanent.

A consultant will offer a reference architecture that is really a product diagram. Ask them to mark each layer with an owner inside the department. If they cannot, it is not a reference architecture. It is a sales artefact.

If a layer has no artefact, mark it zero. Do not average a zero into a polite score.