Egress-Controlled On-Premises AI: Prove It Runs Without Hidden Callouts

An AI platform can sit in your data center, run a local model, and store every prompt locally—yet still stop when it cannot reach the internet.

The dependency is rarely shown on the architecture diagram. A licence server validates at startup. A runtime checks a public model repository. A package manager resolves a component during cold start. An observability library sends usage data to a default endpoint. Identity federation, certificate status, DNS, time synchronization, crash reporting, update checks, and vulnerability feeds can each introduce a callout nobody included in the sovereignty review.

A defensible on-premises deployment should answer two questions: which outbound connections are permitted, and which capabilities remain available when all of them fail? The proof is an egress inventory, default-deny enforcement, internal substitutes for necessary services, and a repeatable disconnected-operation test.

Local inference is not local operation

Local inference establishes where model computation happens. Local operation means the service can start, authenticate, retrieve, invoke approved tools, log, recover, and remain governable without an unapproved external control plane.

Map dependencies across the complete lifecycle:

Test the cold path. A warm replica may work while a replacement node fails because it tries to retrieve weights, a tokenizer, a plug-in, or a licence token.

Require a declared purpose for every destination

Discover traffic by observing DNS queries, connection attempts, proxy requests, TLS destinations, and application logs during install, upgrade, rollback, scale-out, backup, and recovery. Run long enough to capture periodic licence and telemetry activity.

Observation is not approval. For every destination, record the component owner, purpose, protocol, expected payload class, authentication method, failure behavior, and expiry date. Identify whether prompts, retrieved content, user identifiers, logs, or model metadata can leave the boundary.

Avoid wildcard destinations. Prefer an authenticated enterprise proxy or a staged transfer zone that presents stable internal endpoints to production. Updates and model imports should follow the secure artifact pipeline: fetch into quarantine, verify and evaluate the immutable release, then promote its digest into an internal registry. Production model servers should not download from public repositories.

Enforce default-deny at several layers

Kubernetes states that pods are non-isolated for egress by default. A selecting NetworkPolicy with egress rules is required, policies combine additively, and the network plug-in must actually enforce them.

Use overlapping controls:

1. workload policies restrict destinations and ports;
2. namespace policy prevents a permissive service becoming a relay;
3. an authenticated proxy associates approved traffic with workload identity;
4. DNS policy logs queries and blocks unapproved resolvers;
5. firewalls cover nodes, appliances, and the management plane;
6. application settings disable cloud fallbacks, telemetry, and automatic downloads.

NIST SP 800-53 places these concerns within boundary protection, including authenticated proxies, restrictions on outbound communication, and controls against exfiltration. The zero-trust architecture for on-premises AI adds identity: an allowed route should still require a verified workload and explicit purpose.

Test a real blackout

Run production-equivalent scenarios while all unapproved egress is denied:

• deploy a new replica from internal artifacts;
• load every production model from cold state;
• authenticate users and service identities;
• execute RAG, agent tools, approvals, and local fallbacks;
• rotate certificates and credentials;
• restart data- and control-plane components;
• complete backup, restore, and rollback;
• cross a scheduled licence refresh;
• keep isolation active long enough to expose periodic jobs.

Capture every denied lookup and connection. Classify it as required, optional, obsolete, misconfigured, or unknown. An unknown call is a failed test until its owner explains it. Optional callouts should be disabled so background noise does not train operators to ignore a genuine exfiltration signal.

Also remove the approved proxy itself. The platform should fail predictably and must never switch to a public model or alternative endpoint without policy approval.

Evidence and the VDF AI deployment model

Keep a versioned dependency register, enforcement policies, observed-flow report, blackout test results, internal mirror inventory, offline licence and certificate procedures, and time-bounded emergency support process. Re-run the test after changes to the platform, model runtime, observability, identity, or licensing.

VDF AI runs local models, private retrieval, agent orchestration, and execution evidence inside the customer’s environment. VDF AI Agents can use enterprise-hosted model endpoints and internal tools; VDF AI Networks records model, tool, status, and fallback decisions across a workflow.

The surrounding infrastructure must still supply internal registries, identity, DNS, time, logging, and controlled update transfer. The strongest proof is operational: disconnect unapproved routes, restart the platform, run the important workflows, and show that the governance record remains complete.