What Breaks When You Air-Gap an Agent Platform

The integrator had shown a beautiful agent in the connected lab. It searched the web, called a maps API, asked a hosted vision model about a photo, wrote a ticket in a cloud ITSM, and asked a larger hosted model to critique its own plan. The department said they needed it air-gapped. On the Monday after the move, the agent could retrieve from the local corpus and draft. Everything else returned errors. The project was called a failure. It was a translation problem.

Agentic platforms are assembled from tools that assume a WAN. Air-gapping does not make those tools virtuous. It makes them gone. If you do not publish the gone list before the move, someone will restore the demo by restoring the WAN.

This teardown is the gone list we write with SIs, plus the substitutions that are honest. It is also a permission slip to reduce scope. A local drafter with three internal tools is a product. A broken copy of a lab demo is not.

The gone list

Pin this table to the project room. Every restored lab feature is a suspected hole.

Lab feature	Why it dies	Honest substitution
Web search and browsing	No untrusted network	A dated internal corpus; human research for fresh facts
Hosted vision / OCR / speech	Those endpoints are outside	Local models, even if worse; or do not accept that modality
Hosted judge / larger critic model	The critic was never local	Smaller local judge; human spot checks; frozen eval
Cloud ITSM / mail / calendar tools	SaaS	On-estate ticket store; no mail-sending agent unless mail is local
Automatic model and guardrail updates	No live pull	Signed media promotion
Licence and feature-flag services	They phone home	Offline licence; local flags
Marketplace plugins	They are arbitrary outbound	A written allow-list of local tools only
Shared vendor memory in the cloud	Memory was never yours	Local memory store with a retention clock

What still works and is often enough

Retrieval over a corpus you already hold. Drafting against that corpus. Tool calls to internal databases you already trust for that purpose. Human approval steps. Structured outputs into an internal system. Those are the jobs most ministries actually have. They do not require a maps API.

Multi-step planning still works if the planner and the tools are local. What dies is unplanned tool invention. That is a safety win. An agent that cannot grow a new outbound tool at runtime is a better colleague in a secretariat.

Memory, schedulers and the agent that cannot phone a friend

Long-term memory features often assume a hosted store. On the dark side, memory is a database you operate, with a retention clock and a delete-by-principal path. If the product cannot run memory that way, turn memory off. An agent that forgets between shifts is safer than an agent that remembers in a place you cannot erase.

Schedulers that fan work to other agents often assume HTTP to a vendor control plane. Rebuild the fan-out as local processes and a local queue. If you cannot, you do not have a multi-agent system on this estate. You have a single agent and a wish.

Time-aware tools break in a quieter way. An agent that cites today needs a clock and a corpus that was promoted today. If your inward bundle is weekly, teach officers that the assistant is current as of the last promotion stamp, which should be visible in the UI. A confident answer about this morning’s gazette, when the gazette is not in the corpus, is a hallucination you designed by omitting the stamp.

Objections

The user story said agentic, so we need tools. Agentic means the system can plan over tools you gave it. It does not mean it can acquire the internet.

Quality will be uncompetitive. Competitive with what? A leaky demo, or a clerk with a binder? Measure against the binder.

We will keep just one hosted tool. Then you are not air-gapped. Write the posture down correctly and apply the on-prem leak article instead.

How to tell the owner the demo was a lie

Do not say the product is worse air-gapped. Say the connected demo was a different product. Show the gone list as a table of jobs the department does not actually have — maps, web search, a critic model — and the jobs it does have, which still work. Owners forgive a smaller product. They do not forgive a surprise.

Bring a clerk. Ask the clerk whether they needed the maps pin last Tuesday. If they did not, kill it in the room. If they did, you picked the wrong posture or the wrong workflow. That conversation belongs before the purchase order, not after the VLAN is dark.

Write the acceptance in the owner’s words. We accept that the assistant will not browse, will not call a hosted vision model, and will show the date of the last corpus promotion. That sentence, signed, is more valuable than a requirements document that still lists agentic as a feature.

A 30-day de-scoping before the move

1. Days 1–7: inventory every tool the lab agent can call.
2. Days 8–15: mark each keep-local, substitute, or kill.
3. Days 16–25: rebuild the demo on a VLAN with no default route using only keep-local tools.
4. Days 26–30: show the reduced demo to the owner. Get a written acceptance of the gone list. Only then schedule the move.

What goes in the file

The gone list with owner initials, the reduced tool graph, the written acceptance, and a sentence that feature parity with the connected lab was rejected. That sentence will save you when a new secretary asks why the maps pin is missing.

Prcept agents on an air-gap should ship with a short tool graph and no hidden hosted critic. If a demo needs the internet, it is the wrong demo for that estate.

How to prove this on a rack, not on a slide

“What Breaks When You Air-Gap an Agent Platform” only matters if a CISO can fail it. A P4 System Integrator should be able to point at a cable, a registry, a licence file, a PDU reading or a SIEM index and say: this is the control. If the only evidence is a brochure that mentions “air-gapped agentic AI limitations”, you do not have the control.

Air-gap an agent and the demo features fall off. That is the point. List what you will not have, or the missing feature will come back as a tunnel. Air-gap and on-prem programmes die in the second month, when the first update, the first crash, or the first GPU lead-time slip arrives. Budget the boring path — media, offline licence, local registry, local traces — in the same note as the model name.

On-prem is not air-gapped. An India region is not either. Write the forbidden path (outbound HTTPS, licence phone-home, crash reporter, hidden model API) as a numbered list and test it with the internet off. Whatever still dies was a dependency you did not draw.

1. Draw the data path for one user-visible answer under “air-gapped agentic AI limitations”.
2. Disable outbound internet on staging and run the demo script.
3. List every remaining hop: update, licence, registry, NTP, DNS, SIEM.
4. Give each hop an owner inside the department, not only the SI.
5. Minute the restore or the media-transfer once before go-live.

Close this loop before the next CAB

Put “What Breaks When You Air-Gap an Agent Platform” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 System Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “air-gapped agentic AI limitations” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“What Breaks When You Air-Gap an Agent Platform” belongs in a file, not only in a search result. A P4 System Integrator should be able to point at one artefact that proves “air-gapped agentic AI limitations”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Air-gap an agent and the demo features fall off. That is the point. List what you will not have, or the missing feature will come back as a tunnel. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C2 Air-Gapped & On-Prem: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “air-gapped agentic AI limitations”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.