[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"portal-settings:stajic:es":3,"public-menus:all":38,"post:air-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access:es":205,"related:post:air-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access:es:1":3703},{"statusCode":4,"data":5,"message":37},200,{"tenantId":6,"lang":7,"defaultLang":8,"siteUrl":9,"contactEmail":10,"brandName":11,"logoUrl":12,"siteName":11,"siteDescription":13,"ogImage":10,"robotsIndex":14,"socialLinks":10,"reservedSlugs":10,"seoPolicy":15},"stajic","es","de","https:\u002F\u002Fstajic.de",null,"Stajic Platform","\u002FLogo_Planet.svg","Stajic Portal",true,{"branding":16,"relatedContent":17,"crossDomainLinks":18},{"logoUrl":12},{"enabled":14},[19,22,25,28,31,34],{"url":20,"label":21,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Ffigure.rocks","figure.rocks",{"url":23,"label":24,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Floving.rocks","loving.rocks",{"url":26,"label":27,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.com","bazify.com",{"url":29,"label":30,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.de","bazify.de",{"url":32,"label":33,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.at","bazify.at",{"url":35,"label":36,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.ba","bazify.ba","Portal settings resolved",[39,45],{"id":40,"name":41,"location":42,"isActive":14,"isDefault":43,"items":44},1,"main-navigation","header",false,[],{"id":46,"name":47,"location":48,"isActive":14,"isDefault":14,"items":49},4,"main-menu","sidebar",[50,66,79,93,103,118,133],{"id":51,"title":52,"url":60,"target":61,"icon":62,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":64,"portfolioId":10,"children":65},"item-18",{"de":53,"en":54,"es":55,"fr":56,"it":54,"ru":57,"sr":58,"zh":59},"Startseite","Home","Inicio","Accueil","Главная","Почетна","首页","\u002Ffull-stack-web-developer-munich-performance-seo-and-maintainable-builds","_self","i-lucide-home","page",111,[],{"id":67,"title":68,"url":75,"target":61,"icon":76,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":77,"portfolioId":10,"children":78},"item-22",{"de":69,"en":69,"es":70,"fr":69,"it":71,"ru":72,"sr":73,"zh":74},"Vision","Visión","Visione","Видение","Визија","想象","\u002Fueber-uns-webdesign-muenchen-webaplikation","i-lucide-eye",113,[],{"id":80,"title":81,"url":89,"target":61,"icon":90,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":91,"portfolioId":10,"children":92},"item-19",{"de":82,"en":83,"es":84,"fr":83,"it":85,"ru":86,"sr":87,"zh":88},"Leistungen","Services","Servicios","Servizi","Услуги","Услуге","服务","\u002Fservices-dienstleistungen-muenchen","i-lucide-wrench",116,[],{"id":94,"title":95,"url":99,"target":61,"icon":100,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":101,"portfolioId":10,"children":102},"item-23",{"de":96,"en":96,"es":96,"fr":96,"it":96,"ru":97,"sr":97,"zh":98},"Blog","Блог","博客","\u002Fblog","i-lucide-book-open",112,[],{"id":104,"title":105,"url":114,"target":61,"icon":115,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":116,"portfolioId":10,"children":117},"item-32",{"de":106,"en":107,"es":108,"fr":109,"it":110,"ru":111,"sr":112,"zh":113},"Neue Technologien","New Technologies","Nuevas tecnologías","Nouvelles technologies","Nuove tecnologie","Новые технологии","Нове технологије","新技术！","\u002Fneue-webtechnologien","i-lucide-sparkles",122,[],{"id":119,"title":120,"url":129,"target":61,"icon":130,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":131,"portfolioId":10,"children":132},"item-20",{"de":121,"en":122,"es":123,"fr":124,"it":125,"ru":126,"sr":127,"zh":128},"Kontakt","Contact us!","Contacto","Contact","Contatto","Контакт","Контактирајте нас","联系我们！","\u002Fcontact","i-lucide-mail",115,[],{"id":134,"title":135,"url":144,"target":61,"icon":145,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":147},"item-21",{"de":136,"en":137,"es":138,"fr":139,"it":140,"ru":141,"sr":142,"zh":143},"Unsere Arbeit","Our Work","Nuestro trabajo","Nos réalisations","I nostri lavori","Наши работы","Наши радови","文件夹","\u002Fportfolio","i-lucide-briefcase",114,[148,161,175,181,193],{"id":149,"title":150,"url":144,"target":61,"icon":159,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":160},"item-24",{"de":151,"en":152,"es":153,"fr":154,"it":155,"ru":156,"sr":157,"zh":158},"Alle Projekte","All Projects","Todos los proyectos","Tous les projets","Tutti i progetti","Все проекты","Сви пројекти","所有项目","i-lucide-grid-3x3",[],{"id":162,"title":163,"url":171,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":174},"item-29",{"de":164,"en":165,"es":166,"fr":167,"it":168,"ru":169,"sr":170,"zh":143},"Local Roots, Global Reach","Local Roots - Global Reach","Empresa local ","Entreprise locale","Azienda locale","Местная компания","Локално предузеће глобално тржиште","\u002Fportfolio\u002Flocal-roots-global-reach-communication-media-systems-for-modern-business","i-lucide-folder","custom",[],{"id":176,"title":177,"url":179,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":180},"item-28",{"de":178,"en":178,"es":178,"fr":178,"it":178,"ru":178,"sr":178,"zh":178},"Solr Suggester","\u002Fportfolio\u002Fsolr-fuzzy-suggester-und-solr-infix-suggester-abfrage-ueber-ajax-und-filterung",[],{"id":182,"title":183,"url":191,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":192},"item-27",{"de":184,"en":185,"es":186,"fr":187,"it":188,"ru":189,"sr":190,"zh":185},"Firmenwebseite SEO","Company Website SEO","Sitio web corporativo SEO","Site web d’entreprise SEO","Sito web aziendale SEO","Корпоративный сайт SEO","Пословна веб-страница SEO","\u002Fportfolio\u002Fseo-sem-branding-mobile-webseite-muenchen",[],{"id":194,"title":195,"url":203,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":204},"item-31",{"de":196,"en":197,"es":198,"fr":199,"it":200,"ru":201,"sr":202,"zh":197},"Digitalisierungsportal","Digitalization Portal","Portal de digitalización","Portail de numérisation","Portale di digitalizzazione","Портал цифровизации","Портал за дигитализацију","\u002Fportfolio\u002Fdigitalisierungsportal-archiv-museum-bibliothek-ead-lido-mets-mods",[],{"statusCode":4,"data":206,"message":3702},{"id":207,"title":208,"slug":209,"content":210,"contentJson":211,"excerpt":1687,"featuredImage":1688,"featuredImageAlt":1689,"featuredImageCaption":10,"featuredImageTitle":10,"featuredImageCopyright":10,"featuredImageAuthor":10,"featuredImageSourceUrl":10,"featuredImageLicense":10,"featuredImageIsAiGenerated":43,"status":1690,"publishedAt":1691,"createdAt":1692,"updatedAt":1693,"seoLocalePaths":1694,"categories":1703,"author":1716,"translations":1721},"494","IA con aislamiento de red: cómo funcionan los sistemas de IA sin acceso a Internet ni a la nube","air-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u003Cp>La IA con aislamiento físico (air-gapped) es un sistema de IA desplegado dentro de un dominio de seguridad que no tiene conexión de red física con los sistemas externos de los que está separado, y cualquier transferencia a través de esa frontera se realiza mediante procedimientos deliberadamente controlados y no automatizados. Por lo tanto, el modelo de IA, el entorno de ejecución, los datos, los índices de recuperación, las herramientas y las dependencias operativas necesarias para la inferencia deben estar disponibles dentro del entorno aislado. La IA con aislamiento físico no es simplemente \"un modelo local\" o \"un servidor local\": la propiedad que la define es la frontera de red y de transferencia en torno al sistema completo.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--info my-6 rounded-xl border p-5 border-blue-300 bg-blue-50 dark:border-blue-900 dark:bg-blue-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Respuesta directa\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Un sistema de IA con aislamiento físico puede ejecutar inferencia de LLM, RAG, análisis de documentos e incluso flujos de trabajo agénticos sin internet ni API en la nube si todas las dependencias necesarias están disponibles dentro del dominio aislado.\u003Cbr>\u003Cbr>Una arquitectura práctica es:\u003Cbr>\u003Cstrong>importación controlada → repositorios internos de artefactos\u002Fmodelos → entorno de ejecución de IA local → datos\u002FRAG locales → herramientas locales → usuarios\u002Fservicios internos → monitoreo\u002Fauditoría local\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>La parte difícil no es hacer que un LLM responda sin conexión. Es operar todo el ciclo de vida de la IA —actualizaciones, modelos, controladores, paquetes, importaciones de datos, credenciales, registro y seguridad— sin depender silenciosamente de servicios externos.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">El aislamiento físico tiene un significado más estricto que "sin internet"\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">El glosario de ciberseguridad del NIST define un air gap como una interfaz donde dos sistemas \u003Cstrong>no están conectados físicamente\u003C\u002Fstrong> y donde cualquier transferencia lógica \u003Cstrong>no es automatizada\u003C\u002Fstrong>; los datos cruzan solo manualmente bajo control humano. La documentación de proveedores a veces usa "air-gapped" o "desconectado" de forma más amplia para entornos sin conexión a internet externa pero con redes internas e infraestructura de preparación controlada. La documentación de arquitectura debe indicar qué significado se implementa realmente.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Aislamiento físico no significa seguro por definición\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Eliminar la conectividad de red directa elimina muchas rutas remotas, pero no elimina medios extraíbles maliciosos, importaciones de software\u002Fmodelos comprometidos, amenazas internas, servicios internos vulnerables, compromiso físico, inyección de prompts a través de documentos importados o movimiento lateral dentro de la red aislada.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Nota de fuentes actuales — 8 de octubre de 2026\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">La documentación actual de NVIDIA NIM y Red Hat AI Inference admite el servicio de LLM sin acceso a internet externo mediante la preparación previa de activos de modelos y contenedores. NVIDIA documenta una fase de preparación conectada seguida de una fase de ejecución aislada con activos locales y sin credenciales de registro en la nube. Red Hat utiliza repositorios espejo de contenedores\u002Fmodelos para entornos OpenShift desconectados. Estos son ejemplos de implementación útiles, pero no anulan la definición más estricta de air gap del NIST.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cnav class=\"editorjs-toc\" data-editorjs-toc=\"true\" aria-label=\"Contenido\">\u003Cstrong class=\"editorjs-toc__title\">Contenido\u003C\u002Fstrong>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-0\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-7\" class=\"editorjs-toc__link\">Qué significa realmente la IA con aislamiento físico\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-11\" class=\"editorjs-toc__link\">El ejemplo más simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-17\" class=\"editorjs-toc__link\">Dónde se detiene el ejemplo simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-21\" class=\"editorjs-toc__link\">IA con air-gap vs offline vs local vs on-premises vs privada vs soberana\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-25\" class=\"editorjs-toc__link\">Air gap estricto vs despliegue desconectado práctico\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-28\" class=\"editorjs-toc__link\">Una arquitectura práctica de IA con air-gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-32\" class=\"editorjs-toc__link\">Los modelos deben estar preconfigurados\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-36\" class=\"editorjs-toc__link\">Los modelos con dependencias de código remoto son un peligro para el air-gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-40\" class=\"editorjs-toc__link\">Contenedores, paquetes y controladores se convierten en artefactos locales de la cadena de suministro\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-44\" class=\"editorjs-toc__link\">Conozca la factura completa de dependencias\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-46\" class=\"editorjs-toc__link\">Los espejos internos son infraestructura, no una comodidad\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-50\" class=\"editorjs-toc__link\">RAG puede funcionar completamente con aislamiento de red\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-56\" class=\"editorjs-toc__link\">Los agentes pueden ejecutarse con aislamiento de red, pero solo con herramientas accesibles\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-60\" class=\"editorjs-toc__link\">MCP no elude el aislamiento de red\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-64\" class=\"editorjs-toc__link\">La identidad y la autenticación también deben funcionar sin conexión\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-68\" class=\"editorjs-toc__link\">El tiempo, los certificados y los almacenes de confianza se convierten en dependencias locales\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-72\" class=\"editorjs-toc__link\">La telemetría y los informes de fallos necesitan una política explícita\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-76\" class=\"editorjs-toc__link\">Los sistemas con aislamiento de red siguen necesitando parches\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-80\" class=\"editorjs-toc__link\">Una ruta de actualización controlada\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-82\" class=\"editorjs-toc__link\">La frontera de transferencia es la interfaz operativa más sensible\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-86\" class=\"editorjs-toc__link\">Los medios extraíbles no son un conducto neutral\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-90\" class=\"editorjs-toc__link\">El aislamiento de red aumenta la importancia de la cadena de suministro\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-94\" class=\"editorjs-toc__link\">La preparación para el air-gap debe probarse, no asumirse\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-97\" class=\"editorjs-toc__link\">Almacenado en caché una vez no es lo mismo que listo para air-gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-101\" class=\"editorjs-toc__link\">¿Qué amenazas permanecen dentro de un air gap?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-103\" class=\"editorjs-toc__link\">Qué mejora realmente un air gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-107\" class=\"editorjs-toc__link\">Qué dificulta un air gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-109\" class=\"editorjs-toc__link\">IA con aislamiento físico vs IA privada\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-113\" class=\"editorjs-toc__link\">IA con aislamiento físico vs IA soberana\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-117\" class=\"editorjs-toc__link\">Evidencia de la implementación original: qué demuestra el Aaasaasa AI Client y qué no\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-123\" class=\"editorjs-toc__link\">¿Cuándo está justificada la IA con aislamiento físico?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-127\" class=\"editorjs-toc__link\">Una secuencia práctica de diseño de IA con air gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-129\" class=\"editorjs-toc__link\">Lista de verificación de arquitectura de IA con air gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-131\" class=\"editorjs-toc__link\">Modos de fallo comunes de IA con air gap\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-133\" class=\"editorjs-toc__link\">Conceptos erróneos comunes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-135\" class=\"editorjs-toc__link\">Limitaciones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-141\" class=\"editorjs-toc__link\">Qué cambiaría esta respuesta\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-145\" class=\"editorjs-toc__link\">Conocimiento canónico relacionado\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-150\" class=\"editorjs-toc__link\">Preguntas frecuentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-152\" class=\"editorjs-toc__link\">Glosario\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-154\" class=\"editorjs-toc__link\">Conclusión\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-158\" class=\"editorjs-toc__link\">Fuentes primarias y referencias de implementación actuales\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fnav>\n\u003Ch2 id=\"section-7\">Qué significa realmente la IA con aislamiento físico\u003C\u002Fh2>\n\u003Cp>La palabra IA no cambia el concepto básico de seguridad. Un air gap es una frontera entre dominios de seguridad. La IA simplemente hace que el lado aislado sea más exigente operativamente porque las pilas de IA modernas normalmente asumen modelos descargables, registros de paquetes, telemetría, API, hubs de modelos y actualizaciones de software frecuentes.\u003C\u002Fp>\n\u003Cp>El entorno aislado aún puede contener muchas máquinas conectadas. Un clúster interno puede tener GPU, servidores de aplicaciones, almacenamiento, bases de datos, servicios de identidad y monitoreo conectados entre sí. El air gap existe entre ese enclave y el dominio externo.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la pregunta relevante no es \"¿Esta GPU tiene Wi-Fi?\" sino \"¿Puede este entorno de IA intercambiar información con el dominio externo a través de una ruta física o lógica automatizada?\"\u003C\u002Fp>\n\u003Ch2 id=\"section-11\">El ejemplo más simple\u003C\u002Fh2>\n\u003Cp>Imagina que una empresa quiere un asistente interno para documentos técnicos confidenciales, pero no se permite que el entorno envíe esos documentos a internet.\u003C\u002Fp>\n\u003Cp>La empresa descarga un LLM aprobado, un modelo de embeddings, imágenes de contenedores y paquetes de software en un entorno de preparación conectado. Tras la validación, los artefactos aprobados se transfieren al entorno aislado.\u003C\u002Fp>\n\u003Cp>Dentro del enclave, el servidor de modelos, el analizador de documentos, la base de datos vectorial, la aplicación y los servicios de identidad se ejecutan localmente. Los usuarios pueden hacer preguntas y usar RAG sobre documentos internos sin un modelo en la nube ni un registro público de modelos.\u003C\u002Fp>\n\u003Cp>Cuando se requiere una actualización, la actualización pasa de nuevo por el proceso de importación controlada en lugar de ser descargada directamente por el servidor de IA de producción.\u003C\u002Fp>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Un ciclo operativo básico de IA con aislamiento físico\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Adquirir fuera del enclave\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Descargar modelos, paquetes, contenedores, controladores, firmas y documentación aprobados en un entorno de preparación conectado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Verificar antes de la transferencia\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Comprobar procedencia, firmas\u002Fsumas de verificación, estado de malware, licencias y compatibilidad según la política organizacional.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Transferir a través de una frontera controlada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Mover los artefactos aprobados utilizando el proceso manual o mediado autorizado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Publicar internamente\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Colocar los artefactos en repositorios internos de modelos, contenedores, paquetes o archivos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Desplegar localmente\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Ejecutar inferencia, RAG, aplicaciones y herramientas sin dependencias externas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Monitorear dentro del enclave\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Recopilar registros, métricas, estado del modelo\u002Fentorno de ejecución y eventos de seguridad localmente.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Exportar solo evidencia aprobada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Mover informes o artefactos seleccionados hacia afuera mediante el proceso controlado inverso cuando la política lo permita.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Repetir para actualizaciones\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Tratar nuevos modelos, parches, corpus y dependencias como nuevas importaciones de la cadena de suministro.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-17\">Dónde se detiene el ejemplo simple\u003C\u002Fh2>\n\u003Cp>Un entorno de producción con aislamiento físico puede ser mucho más grande que una sola estación de trabajo. Puede incluir Kubernetes\u002FOpenShift, registros internos, almacenamiento de objetos, proveedores de identidad, bases de datos vectoriales, observabilidad, infraestructura de respaldo y varios nodos de servicio de modelos.\u003C\u002Fp>\n\u003Cp>Cuantos más servicios existan dentro del enclave, más debe la organización reproducir capacidades que los entornos conectados normalmente consumen de internet.\u003C\u002Fp>\n\u003Cp>Por lo tanto, el air-gapping desplaza la complejidad. Reduce la conectividad externa directa pero aumenta la gestión de artefactos, el parcheo, las dependencias, la cadena de suministro y la responsabilidad operativa dentro del dominio aislado.\u003C\u002Fp>\n\u003Ch2 id=\"section-21\">IA con air-gap vs offline vs local vs on-premises vs privada vs soberana\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Término\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué describe principalmente\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">¿Requiere conectividad a internet\u002Fexterna?\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA local\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La inferencia\u002Fejecución se ejecuta en hardware local\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No; pero puede seguir llamando a servicios en la nube\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA con capacidad offline\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Puede seguir operando sin internet\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No durante la operación offline; la reconexión puede ser normal\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Entorno desconectado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin ruta directa a internet externo desde el entorno de despliegue\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Normalmente no; puede usar réplicas\u002Fbastiones controlados\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA on-premises\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La infraestructura se ejecuta en el entorno propio\u002Fon-prem de una organización\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Podría seguir teniendo conectividad completa a internet\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA privada\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El procesamiento de IA está controlado para cumplir requisitos de privacidad\u002Fconfidencialidad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Específico de la arquitectura; puede estar conectada o desconectada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA con air-gap\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los dominios de seguridad están físicamente desconectados y la transferencia transfronteriza no es automatizada\u002Fmanual bajo una definición estricta\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin ruta externa automatizada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">IA soberana\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Control\u002Fjurisdicción sobre modelos, datos, infraestructura y dependencias\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No necesariamente; la soberanía es más amplia que el aislamiento de red\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Estos términos pueden solaparse pero no son sinónimos. Un servidor Ollama local conectado a internet es IA local, no IA con air-gap. Una plataforma RAG on-premises que llama a un modelo en la nube es infraestructura de aplicación on-premises con inferencia en la nube, no IA con air-gap.\u003C\u002Fp>\n\u003Cp>Un sistema con air-gap suele ser privado por diseño porque los datos permanecen dentro del enclave, pero la privacidad también depende de la autorización, el registro, el manejo de datos, la seguridad física y la política operativa.\u003C\u002Fp>\n\u003Ch2 id=\"section-25\">Air gap estricto vs despliegue desconectado práctico\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Dos significados frecuentemente llamados "air-gapped"\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Air gap estricto\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Despliegue desconectado \u002F sin internet\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Conexión física externa\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Transferencia transfronteriza\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Acceso a internet desde la carga de trabajo de IA\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Redes internas\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Usar el término cuando\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Caside class=\"editorjs-callout editorjs-callout--success my-6 rounded-xl border p-5 border-emerald-300 bg-emerald-50 dark:border-emerald-900 dark:bg-emerald-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Documentar el límite en lugar de confiar en la etiqueta\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Para revisiones de arquitectura y seguridad, escriba la regla real: \u003Cstrong>sin internet saliente\u003C\u002Fstrong>, \u003Cstrong>sin ruta de red externa física\u003C\u002Fstrong>, \u003Cstrong>solo transferencia manual\u003C\u002Fstrong>, o \u003Cstrong>clúster desconectado con bastión\u002Fréplica aprobados\u003C\u002Fstrong>. Eso es más preciso que decir solo "air-gapped".\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-28\">Una arquitectura práctica de IA con air-gap\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Capa\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué debe existir dentro del entorno aislado\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Capa de usuario\u002Faplicación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Interfaz de chat, API, aplicación de negocio o interfaz de agente interno\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identidad y autorización\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autenticación local\u002Finterna, RBAC, permisos de inquilino\u002Frecurso\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Puerta de enlace\u002Ftiempo de ejecución de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Enrutamiento de modelos, política de solicitudes, ensamblaje de contexto y controles de tiempo de ejecución\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Servicio de modelos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Servidor(es) de modelos local(es), pesos, tokenizador\u002Fconfiguración y tiempo de ejecución del acelerador\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">RAG \u002F conocimiento\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Almacén de documentos, analizador, incrustaciones, índices vectoriales\u002Fléxicos, metadatos y procedencia\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas\u002Fservicios\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Solo API internas\u002Flocales y sistemas aprobados accesibles desde el enclave\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Repositorios de artefactos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registro de contenedores local, réplica de paquetes, almacén de modelos y opcionalmente repositorios de SO\u002Factualizaciones\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Observabilidad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registros internos, métricas, trazas y registros de auditoría\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Respaldo\u002Frecuperación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proceso de respaldo local o controlado por separado apropiado para el dominio de seguridad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Límite de transferencia\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proceso de importación\u002Fexportación controlado con inspección y aprobación\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Una arquitectura completa debería poder iniciarse y operar sin consultas DNS, verificaciones de licencia, descargas de paquetes o llamadas API a servicios públicos, a menos que esas dependencias tengan reemplazos internos aprobados.\u003C\u002Fp>\n\u003Cp>Una prueba de diseño útil es desconectar el despliegue de todos los servicios externos e iniciar en frío la pila. Las dependencias ocultas tienden a aparecer durante el inicio, la carga de modelos, la autenticación, la resolución de paquetes o la inicialización de telemetría.\u003C\u002Fp>\n\u003Ch2 id=\"section-32\">Los modelos deben estar preconfigurados\u003C\u002Fh2>\n\u003Cp>Las API de modelos en la nube no están disponibles por definición si la carga de trabajo aislada no tiene ruta hacia ellas. Por lo tanto, el enclave necesita artefactos de modelos ejecutables localmente o un servicio de inferencia alojado internamente.\u003C\u002Fp>\n\u003Cp>La documentación actual de air-gap de NVIDIA NIM utiliza explícitamente un patrón de dos fases: descargar y preparar los activos del modelo en una máquina conectada, transferirlos, luego ejecutar el NIM aislado desde el almacenamiento local sin acceso saliente al registro ni claves de API en la nube.\u003C\u002Fp>\n\u003Cp>Los pesos del modelo son solo parte del conjunto de dependencias. Los tokenizadores, archivos de configuración, adaptadores, metadatos de cuantización y cualquier código de tiempo de ejecución requerido también deben estar presentes.\u003C\u002Fp>\n\u003Ch2 id=\"section-36\">Los modelos con dependencias de código remoto son un peligro para el air-gap\u003C\u002Fh2>\n\u003Cp>Algunos repositorios de modelos contienen código Python personalizado o hooks de tiempo de ejecución que normalmente obtienen código o recursos adicionales.\u003C\u002Fp>\n\u003Cp>La documentación actual de Red Hat AI Inference advierte explícitamente que algunos modelos de Hugging Face que requieren código remoto no pueden operar normalmente en entornos desconectados porque la biblioteca intenta acceder a la red incluso cuando se configura el modo sin conexión.\u003C\u002Fp>\n\u003Cp>La lección práctica es probar toda la ruta de carga de un modelo sin conexión antes de aprobarlo para un despliegue aislado. \"Descargué los pesos\" no es prueba de que el modelo sea autocontenido.\u003C\u002Fp>\n\u003Ch2 id=\"section-40\">Contenedores, paquetes y controladores se convierten en artefactos locales de la cadena de suministro\u003C\u002Fh2>\n\u003Cp>Los entornos conectados extraen habitualmente imágenes de contenedores, paquetes de Python, actualizaciones del sistema operativo y componentes de GPU de registros públicos. Un entorno con aislamiento de red no puede asumir ninguno de esos servicios.\u003C\u002Fp>\n\u003Cp>El modelo de despliegue de IA desconectado de Red Hat utiliza registros espejo internos para imágenes de contenedores y catálogos de operadores. Los modelos se pueden replicar como artefactos OCI o transferir a almacenamiento persistente.\u003C\u002Fp>\n\u003Cp>Para stacks más amplios, el mismo patrón suele aplicarse a paquetes de lenguaje, repositorios de Linux, paquetes de JavaScript y binarios internos: los artefactos aprobados entran una vez a través del proceso de transferencia y luego se sirven desde repositorios internos de confianza.\u003C\u002Fp>\n\u003Ch2 id=\"section-44\">Conozca la factura completa de dependencias\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Clase de dependencia\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Ejemplos\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Artefactos del modelo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pesos, tokenizador, configuración, adaptadores, metadatos de cuantización\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tiempo de ejecución de inferencia\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">vLLM, llama.cpp, Ollama, NIM u otro tiempo de ejecución de servicio\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stack de GPU\u002Ftiempo de ejecución\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Controladores, bibliotecas CUDA\u002FROCm, tiempo de ejecución de contenedores\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Paquetes de aplicación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ruedas de Python, paquetes npm, bibliotecas del sistema\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Contenedores\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aplicación, inferencia, BD, BD vectorial, imágenes de monitoreo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelos RAG\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo de embedding, reranker, modelos de OCR\u002Fvisión\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Datos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Corpus de conocimiento, metadatos, esquemas, conjuntos de datos de evaluación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Material de seguridad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Certificados, paquetes de CA, políticas\u002Fconfiguración, firmas de malware cuando corresponda\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Artefactos operativos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Paneles, reglas de alerta, herramientas de respaldo, runbooks\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Licenciamiento\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Licencias\u002Fderechos compatibles con entornos sin conexión cuando sea necesario\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-46\">Los espejos internos son infraestructura, no una comodidad\u003C\u002Fh2>\n\u003Cp>Un despliegue desconectado se vuelve mantenible cuando el dominio aislado tiene fuentes internas conocidas para artefactos aprobados.\u003C\u002Fp>\n\u003Cp>El enfoque documentado de Red Hat utiliza un registro espejo disponible para el clúster desconectado, de modo que las cargas de trabajo no necesitan registros públicos.\u003C\u002Fp>\n\u003Cp>La misma idea arquitectónica se puede aplicar a almacenes de modelos y repositorios de paquetes. El objetivo es hacer explícitos el origen, la versión y la aprobación de los artefactos en lugar de copiar archivos aleatorios manualmente a cada servidor.\u003C\u002Fp>\n\u003Ch2 id=\"section-50\">RAG puede funcionar completamente con aislamiento de red\u003C\u002Fh2>\n\u003Cp>RAG no requiere internet público. Requiere un corpus recuperable, una canalización de ingesta\u002Findexación y un modelo que pueda usar el contexto recuperado.\u003C\u002Fp>\n\u003Cp>Dentro de un entorno con aislamiento de red, el almacén de documentos, el analizador\u002FOCR, el modelo de embedding, el índice vectorial o léxico, el reranker y el modelo de generación pueden ejecutarse localmente.\u003C\u002Fp>\n\u003Cp>Lo que cambia es la adquisición de fuentes. La búsqueda web en vivo y los conectores de documentos en la nube no están disponibles a menos que se importen datos equivalentes a través del límite controlado.\u003C\u002Fp>\n\u003Cp>Por lo tanto, el corpus se convierte en un artefacto gobernado. Cada importación debe preservar la identidad de la fuente, la fecha\u002Fversión y la procedencia para que los usuarios sepan qué conocimiento contiene realmente el sistema aislado.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">¿Qué es RAG? La explicación más simple de cómo funciona\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">RAG en sí es independiente del alojamiento en la nube. En una arquitectura con aislamiento de red, la recuperación y la generación simplemente deben ser proporcionadas por componentes locales\u002Finternos.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer los fundamentos de RAG →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-56\">Los agentes pueden ejecutarse con aislamiento de red, pero solo con herramientas accesibles\u003C\u002Fh2>\n\u003Cp>Un bucle de agente puede ejecutarse completamente dentro de un enclave aislado si el modelo\u002Fentorno de ejecución y las herramientas requeridas son locales o accesibles en la red interna.\u003C\u002Fp>\n\u003Cp>Una herramienta que depende de GitHub, búsqueda web pública, correo electrónico en la nube o una API de SaaS externa fallará a menos que la arquitectura proporcione un equivalente interno aprobado o un proceso de intercambio asíncrono controlado.\u003C\u002Fp>\n\u003Cp>Por eso el diseño de agentes con aislamiento de red debe comenzar con un inventario de capacidades: cada punto de conexión de herramienta debe clasificarse como interno, importado, no disponible o deliberadamente excluido.\u003C\u002Fp>\n\u003Ch2 id=\"section-60\">MCP no elude el aislamiento de red\u003C\u002Fh2>\n\u003Cp>MCP puede exponer herramientas y recursos locales dentro de un entorno de IA aislado, pero el protocolo no crea conectividad a través del límite de seguridad.\u003C\u002Fp>\n\u003Cp>Un servidor MCP local que lee documentos internos puede funcionar perfectamente sin conexión. No se puede acceder a un servidor MCP remoto en la internet pública desde un enclave estrictamente aislado.\u003C\u002Fp>\n\u003Cp>El mismo principio se aplica a cualquier protocolo de conector: la interoperabilidad es independiente de la autoridad de red.\u003C\u002Fp>\n\u003Ch2 id=\"section-64\">La identidad y la autenticación también deben funcionar sin conexión\u003C\u002Fh2>\n\u003Cp>Una aplicación de IA puede alojarse localmente y aun así depender de un proveedor de identidad en la nube. Esa dependencia oculta rompe el funcionamiento verdaderamente desconectado.\u003C\u002Fp>\n\u003Cp>Por lo tanto, los diseños con aislamiento de red necesitan una arquitectura de identidad que funcione dentro del enclave: directorio local, proveedor de identidad interno, PKI interna, credenciales de servicio locales u otro mecanismo aprobado.\u003C\u002Fp>\n\u003Cp>La autorización sigue siendo necesaria aunque no haya internet. Los aislamientos de red no reemplazan RBAC, el aislamiento de inquilinos ni el privilegio mínimo.\u003C\u002Fp>\n\u003Ch2 id=\"section-68\">El tiempo, los certificados y los almacenes de confianza se convierten en dependencias locales\u003C\u002Fh2>\n\u003Cp>Muchos sistemas de autenticación y registro dependen de una hora fiable. Los certificados caducan. Los almacenes de confianza cambian. Los artefactos firmados necesitan validación.\u003C\u002Fp>\n\u003Cp>Por lo tanto, un enclave desconectado debe tener sincronización horaria interna y un ciclo de vida de certificados\u002Fconfianza que no dependa de alcanzar servicios públicos durante la operación ordinaria.\u003C\u002Fp>\n\u003Cp>Estas son preocupaciones de infraestructura ordinarias que se vuelven visibles solo cuando se prueba una arquitectura sin acceso a internet.\u003C\u002Fp>\n\u003Ch2 id=\"section-72\">La telemetría y los informes de fallos necesitan una política explícita\u003C\u002Fh2>\n\u003Cp>Muchas bibliotecas modernas intentan realizar análisis, comprobaciones de actualizaciones o informes de errores de forma predeterminada.\u003C\u002Fp>\n\u003Cp>En un entorno aislado, esas llamadas deberían deshabilitarse o redirigirse a la observabilidad interna. Los intentos fallidos repetidos de telemetría pueden crear retrasos, registros ruidosos y un comportamiento de inicio inesperado.\u003C\u002Fp>\n\u003Cp>Un despliegue con aislamiento de red debe saber qué componentes intentan salir a la red, incluso si el cortafuegos los bloqueara.\u003C\u002Fp>\n\u003Ch2 id=\"section-76\">Los sistemas con aislamiento de red siguen necesitando parches\u003C\u002Fh2>\n\u003Cp>El aislamiento de red no impide que el software desarrolle vulnerabilidades. Solo cambia la forma en que los parches llegan al sistema.\u003C\u002Fp>\n\u003Cp>NIST enmarca la gestión de parches como mantenimiento preventivo: las organizaciones aún necesitan identificar, adquirir, priorizar, instalar y verificar parches y actualizaciones.\u003C\u002Fp>\n\u003Cp>Por lo tanto, las operaciones con aislamiento de red necesitan una cadencia de importación repetible para paquetes del sistema operativo, imágenes de contenedores, controladores, entornos de ejecución de IA y actualizaciones de seguridad. La disyuntiva está entre la estabilidad del aislamiento y la exposición a vulnerabilidades por software desactualizado.\u003C\u002Fp>\n\u003Ch2 id=\"section-80\">Una ruta de actualización controlada\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Ejemplo de ciclo de vida de actualización para un entorno de IA aislado\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Identificar la actualización requerida\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Un aviso de seguridad, una mejora del modelo o del entorno de ejecución, o una necesidad operativa desencadena el cambio.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Adquirir en un entorno de preparación conectado\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Descargar las versiones exactas junto con firmas\u002Fsumas de verificación y metadatos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Validar la evidencia de la cadena de suministro\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Verificar el origen, la integridad, la compatibilidad y los requisitos de política.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Probar en un entorno de preparación offline representativo\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Confirmar que la actualización funciona sin dependencias de red inesperadas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Aprobar la transferencia\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Aplicar el proceso de cambio y seguridad de la organización.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Importar al repositorio del enclave\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Publicar el artefacto en la fuente interna de confianza.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Desplegar gradualmente\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Aplicar a nodos de prueba\u002Fcanario antes de un despliegue más amplio donde la arquitectura lo permita.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Verificar y registrar\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Confirmar la versión, el estado, el comportamiento y el estado de reversión.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-82\">La frontera de transferencia es la interfaz operativa más sensible\u003C\u002Fh2>\n\u003Cp>Si información externa debe entrar en un sistema con aislamiento de red, el canal de importación se convierte en un punto de control de seguridad importante.\u003C\u002Fp>\n\u003Cp>El Marco de Amenazas Cibernéticas Técnicas de Ciberseguridad de la NSA reconoce explícitamente la replicación a través de medios extraíbles como una vía que los adversarios pueden usar para cruzar hacia redes desconectadas o con aislamiento de red.\u003C\u002Fp>\n\u003Cp>Por eso, el manejo controlado de medios, la inspección, la procedencia, el cifrado cuando sea necesario, el análisis de malware y la separación de roles pueden importar tanto como la propia pila de IA.\u003C\u002Fp>\n\u003Ch2 id=\"section-86\">Los medios extraíbles no son un conducto neutral\u003C\u002Fh2>\n\u003Cp>Las unidades USB y otros medios portátiles pueden contener tanto artefactos legítimos de modelos\u002Fdatos como contenido malicioso.\u003C\u002Fp>\n\u003Cp>La guía de sanitización de medios de NIST trata los medios de almacenamiento como un objeto del ciclo de vida de la confidencialidad que puede requerir borrado, purga o destrucción según la sensibilidad y las necesidades de reutilización.\u003C\u002Fp>\n\u003Cp>El procedimiento exacto de transferencia es específico de cada organización, pero el principio arquitectónico es estable: los medios que cruzan fronteras deben gobernarse como un activo de seguridad, no tratarse como una conveniencia informal.\u003C\u002Fp>\n\u003Ch2 id=\"section-90\">El aislamiento de red aumenta la importancia de la cadena de suministro\u003C\u002Fh2>\n\u003Cp>Un sistema aislado recibe menos entradas externas activas, pero cada binario, modelo, contenedor y paquete importado adquiere mayor relevancia porque el enclave puede confiar en él durante mucho tiempo.\u003C\u002Fp>\n\u003Cp>La guía de NIST sobre la cadena de suministro de software enfatiza la procedencia, el riesgo del proveedor, la gestión de vulnerabilidades, la verificación de software y las prácticas orientadas a SBOM. Estas preocupaciones se vuelven directamente relevantes para la importación de artefactos de IA sin conexión.\u003C\u002Fp>\n\u003Cp>La cadena de suministro de modelos merece la misma atención que la cadena de suministro de aplicaciones: el origen del modelo, la licencia, el hash, el formato, el código requerido, el tokenizador, los adaptadores y el estado de evaluación deben conocerse antes de la importación.\u003C\u002Fp>\n\u003Ch2 id=\"section-94\">La preparación para el air-gap debe probarse, no asumirse\u003C\u002Fh2>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Patrón de validación propuesto\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">La siguiente prueba de preparación para el air-gap es una síntesis de ingeniería, no un método de certificación de NIST ni de un proveedor. Está diseñada para exponer dependencias externas ocultas antes del despliegue.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Prueba\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué demuestra\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Arranque en frío con toda la red saliente bloqueada\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El entorno de ejecución no requiere servicios públicos durante el arranque\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Cargar cada modelo aprobado desde el almacenamiento local\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los pesos\u002Ftokenizadores\u002Fconfiguraciones están completos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reconstruir\u002Fredesplegar solo desde registros internos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los espejos de contenedores\u002Fpaquetes son suficientes\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autenticar usuarios mientras el IdP externo es inalcanzable\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La identidad funciona dentro del enclave\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ejecutar la ingesta y consulta de RAG sin conexión\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La pila de embedding\u002Findexación\u002Frecuperación es local\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ejecutar herramientas de agente representativas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las herramientas no dependen de API externas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reiniciar tras eliminar la caché\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La operación sin conexión no depende accidentalmente de descargas previamente almacenadas en caché\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Avanzar el ciclo de vida simulado de certificados\u002Factualizaciones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las dependencias de confianza y mantenimiento se comprenden\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Importar un nuevo modelo a través de la ruta de preparación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El procedimiento de transferencia\u002Fcambio es operativo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Restaurar desde copia de seguridad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La recuperación no requiere almacenamiento en la nube no disponible\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-97\">Almacenado en caché una vez no es lo mismo que listo para air-gap\u003C\u002Fh2>\n\u003Cp>Un sistema puede parecer sin conexión porque el modelo y los paquetes ya están en caché de un acceso previo a internet.\u003C\u002Fp>\n\u003Cp>Eliminar las cachés o desplegar en un nodo limpio puede revelar archivos de tokenizador faltantes, paquetes de Python, manifiestos de modelos o dependencias de código remoto.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la preparación para el air-gap debe validarse a partir de artefactos internos limpios, no solo desde una estación de trabajo de desarrollador que estuvo conectada previamente.\u003C\u002Fp>\n\u003Ch2 id=\"section-101\">¿Qué amenazas permanecen dentro de un air gap?\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Amenaza\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Por qué el air gap no la elimina\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Artefacto importado comprometido\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El malware\u002Fmodelo\u002Fpaquete puede entrar a través de la ruta de transferencia autorizada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Medios extraíbles maliciosos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La transferencia física puede transportar cargas útiles ejecutables\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Uso indebido por parte de personas internas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ya existen usuarios autorizados dentro del enclave\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Inyección de prompts en documentos importados\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El contenido no confiable puede influir en RAG\u002Fagentes sin internet\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas de agente con privilegios excesivos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las herramientas locales aún pueden dañar sistemas locales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Fuga de datos entre inquilinos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los errores de autorización internos siguen siendo posibles\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Software interno vulnerable\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La falta de conexión externa no elimina errores explotables\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Movimiento lateral\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un nodo comprometido puede atacar otros nodos conectados internamente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dependencias obsoletas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una cadencia de actualización lenta puede dejar vulnerabilidades conocidas sin parchear\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Robo\u002Fmanipulación física\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La seguridad del hardware y los medios sigue siendo crítica\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Mal comportamiento del modelo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La alucinación, el sesgo y el fallo de tareas son independientes de la red\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Envenenamiento de la cadena de suministro\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las fuentes de importación confiables aún pueden verse comprometidas\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-103\">Qué mejora realmente un air gap\u003C\u002Fh2>\n\u003Cp>Un air gap genuino puede reducir materialmente las rutas de ataque que dependen de la conectividad remota directa: comando y control externo, uso indebido de credenciales en la nube, explotación de servicios expuestos a internet y exfiltración accidental de datos a través de API salientes ordinarias.\u003C\u002Fp>\n\u003Cp>También simplifica la residencia de datos en un sentido limitado: los datos de inferencia no pueden enviarse a un servicio en la nube externo si no existe una ruta.\u003C\u002Fp>\n\u003Cp>Esos beneficios son más fuertes cuando el límite de transferencia y los controles de acceso internos son igualmente disciplinados. Un proceso de USB mal gestionado puede socavar el aislamiento previsto.\u003C\u002Fp>\n\u003Ch2 id=\"section-107\">Qué dificulta un air gap\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Área\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Consecuencia operativa\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Actualizaciones de modelos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Transferencia manual\u002Fpor etapas en lugar de extracción directa del centro de modelos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Parches de seguridad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Flujo de trabajo de importación retrasado y gobernado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Instalación de paquetes\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se requieren espejos internos o artefactos preconstruidos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">API de IA en la nube\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No disponibles\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Búsqueda web\u002Fconectores\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No disponibles a menos que los datos se importen por separado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autenticación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Necesita servicios de identidad internos o con capacidad sin conexión\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Monitoreo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Necesita observabilidad interna y exportación controlada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Licencias\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los productos que requieren activación en línea pueden no ser adecuados\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Solución de problemas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No hay acceso en vivo fácil a recursos del proveedor desde el enclave de producción\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Capacidad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Todo el cómputo de inferencia debe existir localmente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Recuperación ante desastres\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las copias de seguridad en la nube pueden no estar disponibles o estar restringidas por políticas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Actualidad del conocimiento\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La información externa llega solo tan rápido como el proceso de importación\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-109\">IA con aislamiento físico vs IA privada\u003C\u002Fh2>\n\u003Cp>La IA privada se centra principalmente en controlar los datos sensibles y el procesamiento de IA. Una plataforma de IA privada puede estar en las instalaciones y aun así acceder a modelos en la nube aprobados o a servicios externos.\u003C\u002Fp>\n\u003Cp>La IA con aislamiento físico es más estricta en cuanto a la conectividad. Un sistema puede ser privado sin estar aislado físicamente, y un sistema aislado físicamente puede seguir teniendo una privacidad deficiente si todos los usuarios internos tienen acceso sin restricciones.\u003C\u002Fp>\n\u003Cp>El objetivo de seguridad debe determinar la arquitectura: la confidencialidad, la soberanía, la resiliencia y el aislamiento son requisitos relacionados pero distintos.\u003C\u002Fp>\n\u003Ch2 id=\"section-113\">IA con aislamiento físico vs IA soberana\u003C\u002Fh2>\n\u003Cp>La IA soberana se refiere al control sobre la cadena de dependencias más amplia: datos, modelos, infraestructura, operadores, jurisdicción y dependencias estratégicas.\u003C\u002Fp>\n\u003Cp>Un aislamiento físico puede respaldar la soberanía al reducir la dependencia externa en tiempo de ejecución, pero no garantiza el control soberano. El enclave puede seguir dependiendo de hardware extranjero, licencias de modelos propietarios o proveedores externos de actualizaciones.\u003C\u002Fp>\n\u003Cp>El siguiente artículo canónico separa esas dimensiones de control de forma explícita.\u003C\u002Fp>\n\u003Ch2 id=\"section-117\">Evidencia de la implementación original: qué demuestra el Aaasaasa AI Client y qué no\u003C\u002Fh2>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Límite de implementación\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Aaasaasa AI Client es evidencia útil para la \u003Cstrong>arquitectura de inferencia local\u003C\u002Fstrong>, la abstracción de proveedores y la separación de la ubicación del entorno de ejecución y del modelo. \u003Cstrong>No es evidencia de un entorno con aislamiento físico desplegado\u003C\u002Fstrong>. El repositorio también admite rutas en la nube y remotas, y ninguna evidencia verificada del proyecto establece un dominio de seguridad físicamente aislado.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cp>El AI Hub separa el agente\u002Fcliente, el proveedor, el modelo y la ubicación de la conexión. Admite la inferencia local con Ollama y la operación de Codex con proveedor local como opciones distintas, en lugar de asumir que todas las solicitudes de IA van a un modelo en la nube.\u003C\u002Fp>\n\u003Cp>El repositorio señala explícitamente que un entorno de ejecución local puede seguir usando un modelo en la nube, mientras que el chat directo con Ollama es inferencia local. Esta distinción es directamente relevante para la arquitectura de aislamiento físico: la ejecución local no demuestra que el modelo o las dependencias que lo rodean estén desconectados.\u003C\u002Fp>\n\u003Cp>La abstracción de proveedores, el descubrimiento de modelos locales y la inferencia local son, por lo tanto, componentes básicos para una arquitectura de producto capaz de soportar aislamiento físico, pero el límite de red, el espejo de dependencias sin conexión, el proceso de transferencia controlada y la identidad\u002Foperaciones sin conexión aún deben diseñarse por separado.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Capacidad verificada del proyecto\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Relevancia para el aislamiento físico\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Inferencia local con Ollama\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Admite la ejecución local de modelos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Rutas de proveedor\u002Fentorno de ejecución local\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reduce la dependencia de la inferencia en la nube\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Separación de proveedor\u002Fmodelo\u002Fentorno de ejecución\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Hace explícitas las dependencias de la nube en lugar de ocultarlas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Permisos centrales\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Admite el control de acceso local a herramientas y datos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">También existe soporte para proveedores en la nube\u002Fremotos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Demuestra que el producto en sí es capaz de funcionar de forma híbrida, no inherentemente con aislamiento físico\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">No hay un límite de despliegue aislado verificado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Evita exagerar la madurez del aislamiento físico\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-123\">¿Cuándo está justificada la IA con aislamiento físico?\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">El aislamiento físico puede estar justificado cuando\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Una arquitectura privada conectada puede ser mejor cuando\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La política de seguridad exige explícitamente dominios físicamente separados\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El requisito principal es solo que los prompts y los datos no sean utilizados por servicios de consumo públicos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los datos clasificados o extremadamente sensibles no pueden cruzar redes externas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los endpoints aprobados de nube empresarial o privados satisfacen los controles de datos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El entorno operativo no tiene conectividad externa fiable\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Hay internet disponible y la agilidad operativa es importante\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La continuidad de la misión no debe depender de la disponibilidad de la nube o del proveedor\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La calidad gestionada del modelo y las actualizaciones rápidas son más valiosas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un entorno regulado o crítico exige una transferencia controlada\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los controles de seguridad estándar pueden satisfacer el modelo de amenaza real\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El acceso externo a SaaS o API está prohibido\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El flujo de trabajo empresarial depende en gran medida de conectores externos\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>El aislamiento físico debe ser un requisito derivado de un modelo de amenaza o de una política, no una característica de prestigio. Tiene valor de seguridad real cuando la ruta de conectividad eliminada es en sí misma inaceptable.\u003C\u002Fp>\n\u003Cp>Para muchos casos de uso empresariales, una red privada estrictamente controlada con restricciones de salida, inferencia local y canales de actualización aprobados puede ofrecer un mejor equilibrio entre seguridad y mantenibilidad que un aislamiento físico estricto.\u003C\u002Fp>\n\u003Ch2 id=\"section-127\">Una secuencia práctica de diseño de IA con air gap\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Diseñar desde el límite hacia adentro\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Definir qué separa el air gap\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Nombrar los dominios de seguridad y si el requisito es separación física estricta o simplemente sin internet.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Inventariar cada dependencia externa\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Modelos, paquetes, registros, identidad, telemetría, licencias, almacenamiento, APIs, DNS\u002Ftiempo y servicios de soporte.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Seleccionar modelos y runtimes con capacidad offline\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Verificar que los activos del modelo y el código del runtime puedan cargarse sin llamadas remotas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Construir repositorios internos de artefactos\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Crear fuentes confiables para contenedores, paquetes, modelos y actualizaciones.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Diseñar la transferencia controlada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Definir preparación, verificación, manejo de medios\u002Fpasarela, aprobación y procedencia.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Construir identidad y autorización internas\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Asegurar que usuarios, servicios y herramientas puedan autenticarse sin dependencias de nube.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Mantener RAG y herramientas locales\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Desplegar conocimiento, embeddings, índices y APIs de servicio requeridas dentro del enclave.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Construir observabilidad interna\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Operar registros, métricas, trazas y monitoreo de seguridad localmente.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">9\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">9. Definir la cadencia de parches\u002Factualizaciones de modelos\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Equilibrar la respuesta a vulnerabilidades con el proceso de importación controlada.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">10\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">10. Probar desde un estado limpio y desconectado\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Arrancar en frío y operar sin cachés heredadas ni acceso a internet oculto.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">11\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">11. Probar rutas de compromiso\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Ejercitar escenarios de medios extraíbles, cadena de suministro, inyección de prompts, insider y movimiento lateral.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">12\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">12. Documentar excepciones y exportaciones\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Cada ruta permitida a través del límite debe tener un propósito, propietario y conjunto de controles nombrados.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-129\">Lista de verificación de arquitectura de IA con air gap\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pregunta\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Evidencia esperada\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué exactamente está aislado de qué?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Límite de dominio de seguridad documentado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿El límite está físicamente desconectado?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Evidencia de arquitectura de red\u002Ffísica si se afirma un air gap estricto\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo cruzan los datos el límite?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Flujo de trabajo desconectado autorizado no automatizado\u002Fmanual o explícitamente documentado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede cada modelo arrancar en frío offline?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Prueba de carga offline\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Están completos los activos de tokenizer\u002Fconfig\u002Fruntime?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Paquete de modelo interno verificado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿De dónde vienen los contenedores\u002Fpaquetes?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Espejo\u002Frepositorio interno confiable\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede la identidad funcionar sin servicios de nube?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ruta de credenciales de servicio\u002FIdP\u002FPKI interna\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede RAG ingerir\u002Fconsultar offline?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ingesta, embeddings, índice y recuperación locales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué herramientas de agente permanecen disponibles?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Inventario de capacidades internas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se importan los parches?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proceso de mantenimiento controlado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se verifican los artefactos?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Controles de integridad\u002Fprocedencia\u002Fmalware\u002Fcadena de suministro\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se gobiernan los medios extraíbles?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Política de manejo y sanitización de medios\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede el sistema ejecutarse después de limpiar las cachés?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Prueba offline en entorno limpio\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Dónde se almacenan los registros y trazas?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Plataforma de observabilidad interna\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se aprueban las exportaciones?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proceso de egreso controlado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué prueba que esto es air-gapped en lugar de meramente local?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Evidencia de límite y transferencia, no la ubicación del modelo\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-131\">Modos de fallo comunes de IA con air gap\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Modo de fallo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué falló realmente\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El modelo local aún descarga tokenizer\u002Fconfig al iniciar\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El paquete del modelo estaba incompleto\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El contenedor hace referencia a un registro público\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El despliegue no era autocontenido\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se requiere identidad en la nube para iniciar sesión\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La aplicación era local pero la identidad no\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se requiere servidor de licencias externo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La dependencia del proveedor contradecía la operación offline\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Falta el modelo de embeddings\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El chat funciona pero la ingesta de RAG falla\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las llamadas de herramientas del agente van a SaaS público\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La arquitectura del agente no era compatible con air gap\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Solo el nodo GPU está aislado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La base de datos, UI o monitoreo aún dependen de servicios externos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las importaciones por USB son informales\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El límite de transferencia se convierte en una ruta de ataque no controlada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin proceso de parches\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El aislamiento crea una deuda de vulnerabilidad creciente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se usa una máquina de desarrollador con caché como prueba\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El despliegue nuevo falla sin internet\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El air gap reemplaza el pensamiento de autorización\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los usuarios\u002Fservicios internos se vuelven sobreprivilegiados\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Se usa la etiqueta air-gapped para un bloqueo de egreso solo con firewall\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La documentación de seguridad exagera el límite real\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-133\">Conceptos erróneos comunes\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Concepto erróneo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Corrección\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“La IA local es IA con air gap.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Local describe dónde se ejecuta la inferencia; air gap describe el límite de seguridad\u002Fred.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Air-gapped significa una sola PC independiente.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un enclave aislado puede contener toda una red interna o clúster.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Sin internet equivale a air gap estricto.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Según la definición de NIST, los sistemas separados también carecen de conexión física y la transferencia a través del límite no es automatizada.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Los air gaps eliminan el riesgo cibernético.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Persisten riesgos de cadena de suministro, medios extraíbles, insider, red interna y aplicación.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“RAG necesita la nube.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">RAG puede ejecutarse completamente con modelos, índices y datos locales.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Los agentes no pueden trabajar offline.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los agentes pueden usar herramientas internas\u002Flocales; simplemente no pueden alcanzar servicios externos no disponibles.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Una vez instalado, el sistema no necesita actualizaciones.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los parches, controladores, modelos y dependencias aún requieren gestión del ciclo de vida.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Un modelo descargado es autocontenido.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los tokenizers, código remoto, bibliotecas o activos del modelo aún pueden desencadenar dependencias de red.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“La IA privada y la IA con air gap son idénticas.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La IA privada es una propiedad de datos\u002Fcontrol; el air gap es una propiedad de conectividad.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“El air gap garantiza la soberanía.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El hardware externo, las licencias, los modelos y la cadena de suministro pueden seguir siendo dependencias.\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-135\">Limitaciones\u003C\u002Fh2>\n\u003Cp>Los air gaps estrictos hacen más lenta la actualización del conocimiento externo porque cada nueva fuente debe pasar por un proceso de transferencia.\u003C\u002Fp>\n\u003Cp>Pueden restringir la elección de modelos cuando las licencias, los requisitos de código remoto, las necesidades de hardware o las APIs exclusivas del proveedor no pueden satisfacerse offline.\u003C\u002Fp>\n\u003Cp>Aumentan el costo operativo porque la infraestructura que normalmente se consume como servicios en la nube debe poseerse y mantenerse internamente.\u003C\u002Fp>\n\u003Cp>También pueden crear latencia de parches: un control de cambios más estricto puede mantener los sistemas estables mientras retrasa la remediación urgente de vulnerabilidades.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la IA con air gap debe evaluarse como una arquitectura de seguridad entre varias, no asumirse como universalmente superior.\u003C\u002Fp>\n\u003Ch2 id=\"section-141\">Qué cambiaría esta respuesta\u003C\u002Fh2>\n\u003Cp>El soporte de proveedores para operación desconectada cambia rápidamente. Nuevos formatos de modelo, artefactos OCI firmados, mecanismos de licencia offline y registros de modelos integrados pueden reducir la fricción operativa.\u003C\u002Fp>\n\u003Cp>La distinción entre air gap estricto y despliegue desconectado seguirá siendo importante incluso si los proveedores continúan usando los términos de manera flexible.\u003C\u002Fp>\n\u003Cp>El principio estable es que las afirmaciones genuinas de air gap dependen del límite del sistema y del mecanismo de transferencia, no de si el LLM se ejecuta localmente.\u003C\u002Fp>\n\u003Ch2 id=\"section-145\">Conocimiento canónico relacionado\u003C\u002Fh2>\n\u003Cp>La IA con aislamiento físico es un nodo de arquitectura de despliegue\u002Fseguridad. La IA privada, la IA soberana y la abstracción de proveedores responden a preguntas diferentes sobre confidencialidad, control y dependencia.\u003C\u002Fp>\n\u003Cp>MLOps\u002FLLMOps se vuelve más exigente dentro de un entorno desconectado porque los ciclos de vida de modelos, paquetes y actualizaciones deben operar a través de repositorios internos y transferencia controlada.\u003C\u002Fp>\n\u003Cp>RAG y la IA agéntica siguen siendo patrones válidos dentro del enclave siempre que sus datos y herramientas estén disponibles internamente.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">La memoria del agente de IA no es RAG: cómo separar memoria, recuperación, estado y contexto\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">La IA con aislamiento físico aún necesita límites internos correctos entre memoria duradera, estado autoritativo, recuperación y contexto del modelo.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer el artículo sobre arquitectura de memoria →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-150\">Preguntas frecuentes\u003C\u002Fh2>\n\u003Csection class=\"editorjs-faq my-6 rounded-xl border border-gray-200 p-5 dark:border-gray-700\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Preguntas frecuentes sobre IA con aislamiento físico\u003C\u002Fh3>\u003Cdiv id=\"faq1\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Qué es la IA con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">La IA con aislamiento físico es IA desplegada dentro de un dominio de seguridad físicamente desconectado de los sistemas externos de los que está separada, con transferencia transfronteriza realizada mediante procedimientos controlados no automatizados bajo la definición estricta de NIST.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq2\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿La IA con aislamiento físico necesita acceso a internet?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No para la inferencia y operación normales. Los modelos, paquetes, datos y servicios requeridos deben estar disponibles dentro del entorno aislado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq3\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Un LLM local está automáticamente aislado físicamente?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. Un modelo local puede ejecutarse en una máquina que aún tiene acceso a internet o utiliza identidad, herramientas o almacenamiento en la nube. El aislamiento físico describe el límite completo del sistema.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq4\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Puede funcionar RAG en una red con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Sí. Los documentos, modelos de embedding, índices vectoriales o léxicos, rerankers y modelos de generación pueden ejecutarse localmente. El conocimiento externo debe importarse a través del límite controlado.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq5\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Pueden funcionar los agentes de IA con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Sí, si sus herramientas y los sistemas requeridos están disponibles dentro de la red aislada. Las API de SaaS público y en la nube no están disponibles sin un mecanismo transfronterizo permitido.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq6\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cómo se actualizan los modelos en un entorno con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Los modelos normalmente se adquieren y validan en un entorno de staging conectado, se transfieren mediante un proceso aprobado y se publican en un repositorio interno de modelos\u002Fartefactos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq7\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿La IA on-premises es lo mismo que la IA con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. On-premises describe la ubicación de la infraestructura. Los sistemas on-prem pueden permanecer conectados a internet.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq8\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿La IA privada es lo mismo que la IA con aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. La IA privada trata sobre requisitos de datos\u002Fcontrol y aún puede usar infraestructura conectada. El aislamiento físico describe específicamente la separación de red\u002Fdominio.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq9\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Un aislamiento físico hace que la IA sea segura?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Elimina o reduce algunos riesgos de conectividad remota, pero no elimina riesgos de cadena de suministro, medios extraíbles, amenazas internas, autorización interna, físicos o de comportamiento del modelo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq10\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cuál es la mejor prueba para la preparación para el aislamiento físico?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Desplegar o iniciar en frío todo el stack en un entorno limpio con toda la conectividad externa no disponible y verificar que los modelos, la identidad, RAG, las herramientas, el monitoreo, las actualizaciones y la recuperación dependan únicamente de artefactos y servicios internos aprobados.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-152\">Glosario\u003C\u002Fh2>\n\u003Csection class=\"editorjs-glossary my-6 rounded-xl border border-gray-200 dark:border-gray-700 p-5\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Términos clave de IA con aislamiento físico\u003C\u002Fh3>\u003Cdl>\u003Cdiv id=\"air-gap\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Aislamiento físico\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Interfaz de dominio de seguridad donde los sistemas no están físicamente conectados y cualquier transferencia lógica transfronteriza es no automatizada\u002Fmanual según la definición del glosario de NIST.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"air-gapped-ai\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">IA con aislamiento físico\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Sistema de IA desplegado dentro de un dominio de seguridad con aislamiento físico con dependencias de inferencia y operativas disponibles localmente.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"disconnected-environment\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Entorno desconectado\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Entorno de despliegue sin acceso directo a internet externo; las implementaciones pueden usar flujos de trabajo controlados de espejo o bastión.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"offline-capable-ai\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">IA con capacidad offline\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Aplicación de IA capaz de operar para algunas o todas sus funciones sin conectividad a internet, sin estar necesariamente aislada de forma permanente.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"local-ai\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">IA local\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Inferencia o runtime de IA que se ejecuta en hardware local en lugar de un endpoint de modelo remoto; no implica aislamiento de red.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"mirror-registry\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Registro espejo\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Repositorio interno que contiene copias aprobadas de imágenes de contenedores u otros artefactos necesarios para un despliegue desconectado.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"staging-environment\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Entorno de staging\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Zona conectada o controlada donde los artefactos se adquieren, verifican y preparan antes de la transferencia a un dominio aislado.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"controlled-transfer\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Transferencia controlada\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Movimiento gobernado de datos o software a través del límite de aislamiento utilizando medios\u002Fprocesos aprobados y verificación.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"artifact-provenance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Procedencia de artefactos\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Información que muestra de dónde proviene un modelo, paquete, contenedor u otro artefacto importado y cómo se produjo o verificó.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"removable-media\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Medios extraíbles\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Almacenamiento portátil utilizado para transferir datos entre sistemas; una posible vía de seguridad a través de dominios desconectados.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"internal-model-store\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Almacén interno de modelos\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Repositorio dentro del entorno aislado desde el cual se sirven o despliegan artefactos de modelos aprobados.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"air-gap-readiness\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Preparación para el aislamiento físico\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Capacidad demostrada de todo el stack de IA para instalarse, iniciarse, operar, actualizarse y recuperarse sin conectividad externa no aprobada.\u003C\u002Fdd>\u003C\u002Fdiv>\u003C\u002Fdl>\u003C\u002Fsection>\n\u003Ch2 id=\"section-154\">Conclusión\u003C\u002Fh2>\n\u003Cp>La IA con aislamiento físico no es un tipo especial de modelo. Es una arquitectura de IA que opera dentro de un dominio de seguridad deliberadamente aislado.\u003C\u002Fp>\n\u003Cp>El modelo puede ser la parte fácil. La preparación para producción depende de si cada dependencia circundante — activos de modelos, paquetes, registros, identidad, RAG, herramientas, monitoreo, actualizaciones y recuperación — puede funcionar sin una ruta externa automatizada.\u003C\u002Fp>\n\u003Cp>La regla confiable más breve es: la inferencia local demuestra dónde se ejecuta el modelo; la evidencia de aislamiento físico demuestra cómo se separa el sistema completo y cómo cada transferencia permitida cruza ese límite.\u003C\u002Fp>\n\u003Ch2 id=\"section-158\">Fuentes primarias y referencias de implementación actuales\u003C\u002Fh2>\n\u003Cp>Las fuentes a continuación establecen la definición de seguridad, los patrones actuales de despliegue de IA desconectada y los riesgos del ciclo de vida. El uso que hacen los proveedores de “air-gapped” se distingue intencionalmente de la definición más estricta de NIST.\u003C\u002Fp>\n\u003Ca href=\"https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fair_gap\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST CSRC — Air gap\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Definición del glosario de NIST: sistemas físicamente desconectados con transferencia lógica no automatizada y controlada manualmente a través del límite.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdocs.nvidia.com\u002Fnim\u002Flarge-language-models\u002Flatest\u002Fdeploy-air-gap.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NVIDIA NIM — Despliegue con aislamiento físico\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía operativa actual para preparar activos de modelos en un sistema conectado y ejecutar NIM desde almacenamiento local sin internet, registros públicos ni claves de API en la nube.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Findex\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Red Hat AI Inference — Despliegue desconectado\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía actual de Red Hat para servir LLM en entornos desconectados con artefactos espejo e infraestructura interna.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Fstoring-models-in-disconnected-environments_disconnected-deploy\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Red Hat AI Inference — Almacenamiento de modelos en entornos desconectados\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía actual que cubre imágenes de modelos OCI, almacenamiento persistente de modelos y limitaciones de modelos que requieren código remoto.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nsa.gov\u002Fportals\u002F75\u002Fdocuments\u002Fwhat-we-do\u002Fcybersecurity\u002Fprofessional-resources\u002Fctr-nsa-css-technical-cyber-threat-framework.pdf\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NSA — Marco técnico de amenazas cibernéticas\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Marco de amenazas que identifica explícitamente la replicación mediante medios extraíbles como una vía de entrada a redes desconectadas o aisladas.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fguidelines-media-sanitization\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST SP 800-88 Rev. 1 — Directrices para el saneamiento de medios\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía para gestionar y sanear medios de almacenamiento de acuerdo con los requisitos de confidencialidad de la información.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F40\u002Fr4\u002Ffinal\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST SP 800-40 Rev. 4 — Planificación de la gestión de parches empresarial\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía que enmarca la aplicación de parches y actualizaciones como mantenimiento preventivo en sistemas empresariales.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fexecutive-order-14028-improving-nations-cybersecurity\u002Fsoftware-security-supply-chains\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST — Seguridad del software en las cadenas de suministro\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía del NIST que cubre el riesgo de la cadena de suministro de software, la procedencia, la verificación, las prácticas relacionadas con SBOM y la gestión de vulnerabilidades.\u003C\u002Fp>\u003C\u002Fa>",{"time":212,"blocks":213,"version":1686},1791488221143,[214,220,228,235,241,248,256,261,266,271,276,281,286,291,296,301,333,338,343,348,353,358,396,401,406,411,446,453,458,496,501,506,511,516,521,526,531,536,541,546,551,556,561,566,571,609,614,619,624,629,634,639,644,649,654,663,668,673,678,683,688,693,698,703,708,713,718,723,728,733,738,743,748,753,758,763,768,773,778,783,788,818,823,828,833,838,843,848,853,858,863,868,873,878,883,889,927,932,937,942,947,952,996,1001,1006,1011,1016,1021,1065,1070,1075,1080,1085,1090,1095,1100,1105,1110,1116,1121,1126,1131,1157,1162,1188,1193,1198,1203,1245,1250,1306,1311,1355,1360,1398,1403,1408,1413,1418,1423,1428,1433,1438,1443,1448,1453,1458,1463,1468,1476,1481,1527,1532,1583,1588,1593,1598,1603,1608,1613,1623,1632,1641,1650,1659,1668,1677],{"id":215,"data":216,"type":218,"tunes":219},"intro",{"text":217},"La IA con aislamiento físico (air-gapped) es un sistema de IA desplegado dentro de un dominio de seguridad que no tiene conexión de red física con los sistemas externos de los que está separado, y cualquier transferencia a través de esa frontera se realiza mediante procedimientos deliberadamente controlados y no automatizados. Por lo tanto, el modelo de IA, el entorno de ejecución, los datos, los índices de recuperación, las herramientas y las dependencias operativas necesarias para la inferencia deben estar disponibles dentro del entorno aislado. La IA con aislamiento físico no es simplemente \"un modelo local\" o \"un servidor local\": la propiedad que la define es la frontera de red y de transferencia en torno al sistema completo.","paragraph",{},{"id":221,"data":222,"type":226,"tunes":227},"direct",{"body":223,"title":224,"variant":225},"Un sistema de IA con aislamiento físico puede ejecutar inferencia de LLM, RAG, análisis de documentos e incluso flujos de trabajo agénticos sin internet ni API en la nube si todas las dependencias necesarias están disponibles dentro del dominio aislado.\u003Cbr>\u003Cbr>Una arquitectura práctica es:\u003Cbr>\u003Cstrong>importación controlada → repositorios internos de artefactos\u002Fmodelos → entorno de ejecución de IA local → datos\u002FRAG locales → herramientas locales → usuarios\u002Fservicios internos → monitoreo\u002Fauditoría local\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>La parte difícil no es hacer que un LLM responda sin conexión. Es operar todo el ciclo de vida de la IA —actualizaciones, modelos, controladores, paquetes, importaciones de datos, credenciales, registro y seguridad— sin depender silenciosamente de servicios externos.","Respuesta directa","info","callout",{},{"id":229,"data":230,"type":226,"tunes":234},"nist-boundary",{"body":231,"title":232,"variant":233},"El glosario de ciberseguridad del NIST define un air gap como una interfaz donde dos sistemas \u003Cstrong>no están conectados físicamente\u003C\u002Fstrong> y donde cualquier transferencia lógica \u003Cstrong>no es automatizada\u003C\u002Fstrong>; los datos cruzan solo manualmente bajo control humano. La documentación de proveedores a veces usa \"air-gapped\" o \"desconectado\" de forma más amplia para entornos sin conexión a internet externa pero con redes internas e infraestructura de preparación controlada. La documentación de arquitectura debe indicar qué significado se implementa realmente.","El aislamiento físico tiene un significado más estricto que \"sin internet\"","warning",{},{"id":236,"data":237,"type":226,"tunes":240},"not-security",{"body":238,"title":239,"variant":233},"Eliminar la conectividad de red directa elimina muchas rutas remotas, pero no elimina medios extraíbles maliciosos, importaciones de software\u002Fmodelos comprometidos, amenazas internas, servicios internos vulnerables, compromiso físico, inyección de prompts a través de documentos importados o movimiento lateral dentro de la red aislada.","Aislamiento físico no significa seguro por definición",{},{"id":242,"data":243,"type":226,"tunes":247},"current",{"body":244,"title":245,"variant":246},"La documentación actual de NVIDIA NIM y Red Hat AI Inference admite el servicio de LLM sin acceso a internet externo mediante la preparación previa de activos de modelos y contenedores. NVIDIA documenta una fase de preparación conectada seguida de una fase de ejecución aislada con activos locales y sin credenciales de registro en la nube. Red Hat utiliza repositorios espejo de contenedores\u002Fmodelos para entornos OpenShift desconectados. Estos son ejemplos de implementación útiles, pero no anulan la definición más estricta de air gap del NIST.","Nota de fuentes actuales — 8 de octubre de 2026","note",{},{"id":249,"data":250,"type":254,"tunes":255},"toc",{"title":251,"maxLevel":252,"minLevel":253},"Contenido",3,2,"tableOfContents",{},{"id":257,"data":258,"type":42,"tunes":260},"h-meaning",{"text":259,"level":253},"Qué significa realmente la IA con aislamiento físico",{},{"id":262,"data":263,"type":218,"tunes":265},"p-meaning-1",{"text":264},"La palabra IA no cambia el concepto básico de seguridad. Un air gap es una frontera entre dominios de seguridad. La IA simplemente hace que el lado aislado sea más exigente operativamente porque las pilas de IA modernas normalmente asumen modelos descargables, registros de paquetes, telemetría, API, hubs de modelos y actualizaciones de software frecuentes.",{},{"id":267,"data":268,"type":218,"tunes":270},"p-meaning-2",{"text":269},"El entorno aislado aún puede contener muchas máquinas conectadas. Un clúster interno puede tener GPU, servidores de aplicaciones, almacenamiento, bases de datos, servicios de identidad y monitoreo conectados entre sí. El air gap existe entre ese enclave y el dominio externo.",{},{"id":272,"data":273,"type":218,"tunes":275},"p-meaning-3",{"text":274},"Por lo tanto, la pregunta relevante no es \"¿Esta GPU tiene Wi-Fi?\" sino \"¿Puede este entorno de IA intercambiar información con el dominio externo a través de una ruta física o lógica automatizada?\"",{},{"id":277,"data":278,"type":42,"tunes":280},"h-simple",{"text":279,"level":253},"El ejemplo más simple",{},{"id":282,"data":283,"type":218,"tunes":285},"p-simple-1",{"text":284},"Imagina que una empresa quiere un asistente interno para documentos técnicos confidenciales, pero no se permite que el entorno envíe esos documentos a internet.",{},{"id":287,"data":288,"type":218,"tunes":290},"p-simple-2",{"text":289},"La empresa descarga un LLM aprobado, un modelo de embeddings, imágenes de contenedores y paquetes de software en un entorno de preparación conectado. Tras la validación, los artefactos aprobados se transfieren al entorno aislado.",{},{"id":292,"data":293,"type":218,"tunes":295},"p-simple-3",{"text":294},"Dentro del enclave, el servidor de modelos, el analizador de documentos, la base de datos vectorial, la aplicación y los servicios de identidad se ejecutan localmente. Los usuarios pueden hacer preguntas y usar RAG sobre documentos internos sin un modelo en la nube ni un registro público de modelos.",{},{"id":297,"data":298,"type":218,"tunes":300},"p-simple-4",{"text":299},"Cuando se requiere una actualización, la actualización pasa de nuevo por el proceso de importación controlada en lugar de ser descargada directamente por el servidor de IA de producción.",{},{"id":302,"data":303,"type":331,"tunes":332},"simple-flow",{"steps":304,"title":329,"orientation":330},[305,308,311,314,317,320,323,326],{"label":306,"description":307},"1. Adquirir fuera del enclave","Descargar modelos, paquetes, contenedores, controladores, firmas y documentación aprobados en un entorno de preparación conectado.",{"label":309,"description":310},"2. Verificar antes de la transferencia","Comprobar procedencia, firmas\u002Fsumas de verificación, estado de malware, licencias y compatibilidad según la política organizacional.",{"label":312,"description":313},"3. Transferir a través de una frontera controlada","Mover los artefactos aprobados utilizando el proceso manual o mediado autorizado.",{"label":315,"description":316},"4. Publicar internamente","Colocar los artefactos en repositorios internos de modelos, contenedores, paquetes o archivos.",{"label":318,"description":319},"5. Desplegar localmente","Ejecutar inferencia, RAG, aplicaciones y herramientas sin dependencias externas.",{"label":321,"description":322},"6. Monitorear dentro del enclave","Recopilar registros, métricas, estado del modelo\u002Fentorno de ejecución y eventos de seguridad localmente.",{"label":324,"description":325},"7. Exportar solo evidencia aprobada","Mover informes o artefactos seleccionados hacia afuera mediante el proceso controlado inverso cuando la política lo permita.",{"label":327,"description":328},"8. Repetir para actualizaciones","Tratar nuevos modelos, parches, corpus y dependencias como nuevas importaciones de la cadena de suministro.","Un ciclo operativo básico de IA con aislamiento físico","auto","processFlow",{},{"id":334,"data":335,"type":42,"tunes":337},"h-stops",{"text":336,"level":253},"Dónde se detiene el ejemplo simple",{},{"id":339,"data":340,"type":218,"tunes":342},"p-stops-1",{"text":341},"Un entorno de producción con aislamiento físico puede ser mucho más grande que una sola estación de trabajo. Puede incluir Kubernetes\u002FOpenShift, registros internos, almacenamiento de objetos, proveedores de identidad, bases de datos vectoriales, observabilidad, infraestructura de respaldo y varios nodos de servicio de modelos.",{},{"id":344,"data":345,"type":218,"tunes":347},"p-stops-2",{"text":346},"Cuantos más servicios existan dentro del enclave, más debe la organización reproducir capacidades que los entornos conectados normalmente consumen de internet.",{},{"id":349,"data":350,"type":218,"tunes":352},"p-stops-3",{"text":351},"Por lo tanto, el air-gapping desplaza la complejidad. Reduce la conectividad externa directa pero aumenta la gestión de artefactos, el parcheo, las dependencias, la cadena de suministro y la responsabilidad operativa dentro del dominio aislado.",{},{"id":354,"data":355,"type":42,"tunes":357},"h-terms",{"text":356,"level":253},"IA con air-gap vs offline vs local vs on-premises vs privada vs soberana",{},{"id":359,"data":360,"type":394,"tunes":395},"terms-table",{"content":361,"stretched":43,"withHeadings":14},[362,366,370,374,378,382,386,390],[363,364,365],"Término","Qué describe principalmente","¿Requiere conectividad a internet\u002Fexterna?",[367,368,369],"IA local","La inferencia\u002Fejecución se ejecuta en hardware local","No; pero puede seguir llamando a servicios en la nube",[371,372,373],"IA con capacidad offline","Puede seguir operando sin internet","No durante la operación offline; la reconexión puede ser normal",[375,376,377],"Entorno desconectado","Sin ruta directa a internet externo desde el entorno de despliegue","Normalmente no; puede usar réplicas\u002Fbastiones controlados",[379,380,381],"IA on-premises","La infraestructura se ejecuta en el entorno propio\u002Fon-prem de una organización","Podría seguir teniendo conectividad completa a internet",[383,384,385],"IA privada","El procesamiento de IA está controlado para cumplir requisitos de privacidad\u002Fconfidencialidad","Específico de la arquitectura; puede estar conectada o desconectada",[387,388,389],"IA con air-gap","Los dominios de seguridad están físicamente desconectados y la transferencia transfronteriza no es automatizada\u002Fmanual bajo una definición estricta","Sin ruta externa automatizada",[391,392,393],"IA soberana","Control\u002Fjurisdicción sobre modelos, datos, infraestructura y dependencias","No necesariamente; la soberanía es más amplia que el aislamiento de red","table",{},{"id":397,"data":398,"type":218,"tunes":400},"p-terms-1",{"text":399},"Estos términos pueden solaparse pero no son sinónimos. Un servidor Ollama local conectado a internet es IA local, no IA con air-gap. Una plataforma RAG on-premises que llama a un modelo en la nube es infraestructura de aplicación on-premises con inferencia en la nube, no IA con air-gap.",{},{"id":402,"data":403,"type":218,"tunes":405},"p-terms-2",{"text":404},"Un sistema con air-gap suele ser privado por diseño porque los datos permanecen dentro del enclave, pero la privacidad también depende de la autorización, el registro, el manejo de datos, la seguridad física y la política operativa.",{},{"id":407,"data":408,"type":42,"tunes":410},"h-strict",{"text":409,"level":253},"Air gap estricto vs despliegue desconectado práctico",{},{"id":412,"data":413,"type":444,"tunes":445},"strict-comparison",{"rows":414,"title":436,"layout":394,"columns":437},[415,420,424,428,432],{"id":416,"label":417,"values":418},"physical","Conexión física externa",[419,419],"",{"id":421,"label":422,"values":423},"transfer","Transferencia transfronteriza",[419,419],{"id":425,"label":426,"values":427},"internet","Acceso a internet desde la carga de trabajo de IA",[419,419],{"id":429,"label":430,"values":431},"internalnet","Redes internas",[419,419],{"id":433,"label":434,"values":435},"best","Usar el término cuando",[419,419],"Dos significados frecuentemente llamados \"air-gapped\"",[438,441],{"id":439,"label":440},"strict","Air gap estricto",{"id":442,"label":443},"disconnected","Despliegue desconectado \u002F sin internet","comparison",{},{"id":447,"data":448,"type":226,"tunes":452},"naming-rule",{"body":449,"title":450,"variant":451},"Para revisiones de arquitectura y seguridad, escriba la regla real: \u003Cstrong>sin internet saliente\u003C\u002Fstrong>, \u003Cstrong>sin ruta de red externa física\u003C\u002Fstrong>, \u003Cstrong>solo transferencia manual\u003C\u002Fstrong>, o \u003Cstrong>clúster desconectado con bastión\u002Fréplica aprobados\u003C\u002Fstrong>. Eso es más preciso que decir solo \"air-gapped\".","Documentar el límite en lugar de confiar en la etiqueta","success",{},{"id":454,"data":455,"type":42,"tunes":457},"h-architecture",{"text":456,"level":253},"Una arquitectura práctica de IA con air-gap",{},{"id":459,"data":460,"type":394,"tunes":495},"architecture-table",{"content":461,"stretched":43,"withHeadings":14},[462,465,468,471,474,477,480,483,486,489,492],[463,464],"Capa","Qué debe existir dentro del entorno aislado",[466,467],"Capa de usuario\u002Faplicación","Interfaz de chat, API, aplicación de negocio o interfaz de agente interno",[469,470],"Identidad y autorización","Autenticación local\u002Finterna, RBAC, permisos de inquilino\u002Frecurso",[472,473],"Puerta de enlace\u002Ftiempo de ejecución de IA","Enrutamiento de modelos, política de solicitudes, ensamblaje de contexto y controles de tiempo de ejecución",[475,476],"Servicio de modelos","Servidor(es) de modelos local(es), pesos, tokenizador\u002Fconfiguración y tiempo de ejecución del acelerador",[478,479],"RAG \u002F conocimiento","Almacén de documentos, analizador, incrustaciones, índices vectoriales\u002Fléxicos, metadatos y procedencia",[481,482],"Herramientas\u002Fservicios","Solo API internas\u002Flocales y sistemas aprobados accesibles desde el enclave",[484,485],"Repositorios de artefactos","Registro de contenedores local, réplica de paquetes, almacén de modelos y opcionalmente repositorios de SO\u002Factualizaciones",[487,488],"Observabilidad","Registros internos, métricas, trazas y registros de auditoría",[490,491],"Respaldo\u002Frecuperación","Proceso de respaldo local o controlado por separado apropiado para el dominio de seguridad",[493,494],"Límite de transferencia","Proceso de importación\u002Fexportación controlado con inspección y aprobación",{},{"id":497,"data":498,"type":218,"tunes":500},"p-architecture-1",{"text":499},"Una arquitectura completa debería poder iniciarse y operar sin consultas DNS, verificaciones de licencia, descargas de paquetes o llamadas API a servicios públicos, a menos que esas dependencias tengan reemplazos internos aprobados.",{},{"id":502,"data":503,"type":218,"tunes":505},"p-architecture-2",{"text":504},"Una prueba de diseño útil es desconectar el despliegue de todos los servicios externos e iniciar en frío la pila. Las dependencias ocultas tienden a aparecer durante el inicio, la carga de modelos, la autenticación, la resolución de paquetes o la inicialización de telemetría.",{},{"id":507,"data":508,"type":42,"tunes":510},"h-models",{"text":509,"level":253},"Los modelos deben estar preconfigurados",{},{"id":512,"data":513,"type":218,"tunes":515},"p-models-1",{"text":514},"Las API de modelos en la nube no están disponibles por definición si la carga de trabajo aislada no tiene ruta hacia ellas. Por lo tanto, el enclave necesita artefactos de modelos ejecutables localmente o un servicio de inferencia alojado internamente.",{},{"id":517,"data":518,"type":218,"tunes":520},"p-models-2",{"text":519},"La documentación actual de air-gap de NVIDIA NIM utiliza explícitamente un patrón de dos fases: descargar y preparar los activos del modelo en una máquina conectada, transferirlos, luego ejecutar el NIM aislado desde el almacenamiento local sin acceso saliente al registro ni claves de API en la nube.",{},{"id":522,"data":523,"type":218,"tunes":525},"p-models-3",{"text":524},"Los pesos del modelo son solo parte del conjunto de dependencias. Los tokenizadores, archivos de configuración, adaptadores, metadatos de cuantización y cualquier código de tiempo de ejecución requerido también deben estar presentes.",{},{"id":527,"data":528,"type":42,"tunes":530},"h-remote-code",{"text":529,"level":253},"Los modelos con dependencias de código remoto son un peligro para el air-gap",{},{"id":532,"data":533,"type":218,"tunes":535},"p-remote-1",{"text":534},"Algunos repositorios de modelos contienen código Python personalizado o hooks de tiempo de ejecución que normalmente obtienen código o recursos adicionales.",{},{"id":537,"data":538,"type":218,"tunes":540},"p-remote-2",{"text":539},"La documentación actual de Red Hat AI Inference advierte explícitamente que algunos modelos de Hugging Face que requieren código remoto no pueden operar normalmente en entornos desconectados porque la biblioteca intenta acceder a la red incluso cuando se configura el modo sin conexión.",{},{"id":542,"data":543,"type":218,"tunes":545},"p-remote-3",{"text":544},"La lección práctica es probar toda la ruta de carga de un modelo sin conexión antes de aprobarlo para un despliegue aislado. \"Descargué los pesos\" no es prueba de que el modelo sea autocontenido.",{},{"id":547,"data":548,"type":42,"tunes":550},"h-artifacts",{"text":549,"level":253},"Contenedores, paquetes y controladores se convierten en artefactos locales de la cadena de suministro",{},{"id":552,"data":553,"type":218,"tunes":555},"p-artifacts-1",{"text":554},"Los entornos conectados extraen habitualmente imágenes de contenedores, paquetes de Python, actualizaciones del sistema operativo y componentes de GPU de registros públicos. Un entorno con aislamiento de red no puede asumir ninguno de esos servicios.",{},{"id":557,"data":558,"type":218,"tunes":560},"p-artifacts-2",{"text":559},"El modelo de despliegue de IA desconectado de Red Hat utiliza registros espejo internos para imágenes de contenedores y catálogos de operadores. Los modelos se pueden replicar como artefactos OCI o transferir a almacenamiento persistente.",{},{"id":562,"data":563,"type":218,"tunes":565},"p-artifacts-3",{"text":564},"Para stacks más amplios, el mismo patrón suele aplicarse a paquetes de lenguaje, repositorios de Linux, paquetes de JavaScript y binarios internos: los artefactos aprobados entran una vez a través del proceso de transferencia y luego se sirven desde repositorios internos de confianza.",{},{"id":567,"data":568,"type":42,"tunes":570},"h-bom",{"text":569,"level":253},"Conozca la factura completa de dependencias",{},{"id":572,"data":573,"type":394,"tunes":608},"dependency-table",{"content":574,"stretched":43,"withHeadings":14},[575,578,581,584,587,590,593,596,599,602,605],[576,577],"Clase de dependencia","Ejemplos",[579,580],"Artefactos del modelo","Pesos, tokenizador, configuración, adaptadores, metadatos de cuantización",[582,583],"Tiempo de ejecución de inferencia","vLLM, llama.cpp, Ollama, NIM u otro tiempo de ejecución de servicio",[585,586],"Stack de GPU\u002Ftiempo de ejecución","Controladores, bibliotecas CUDA\u002FROCm, tiempo de ejecución de contenedores",[588,589],"Paquetes de aplicación","Ruedas de Python, paquetes npm, bibliotecas del sistema",[591,592],"Contenedores","Aplicación, inferencia, BD, BD vectorial, imágenes de monitoreo",[594,595],"Modelos RAG","Modelo de embedding, reranker, modelos de OCR\u002Fvisión",[597,598],"Datos","Corpus de conocimiento, metadatos, esquemas, conjuntos de datos de evaluación",[600,601],"Material de seguridad","Certificados, paquetes de CA, políticas\u002Fconfiguración, firmas de malware cuando corresponda",[603,604],"Artefactos operativos","Paneles, reglas de alerta, herramientas de respaldo, runbooks",[606,607],"Licenciamiento","Licencias\u002Fderechos compatibles con entornos sin conexión cuando sea necesario",{},{"id":610,"data":611,"type":42,"tunes":613},"h-mirror",{"text":612,"level":253},"Los espejos internos son infraestructura, no una comodidad",{},{"id":615,"data":616,"type":218,"tunes":618},"p-mirror-1",{"text":617},"Un despliegue desconectado se vuelve mantenible cuando el dominio aislado tiene fuentes internas conocidas para artefactos aprobados.",{},{"id":620,"data":621,"type":218,"tunes":623},"p-mirror-2",{"text":622},"El enfoque documentado de Red Hat utiliza un registro espejo disponible para el clúster desconectado, de modo que las cargas de trabajo no necesitan registros públicos.",{},{"id":625,"data":626,"type":218,"tunes":628},"p-mirror-3",{"text":627},"La misma idea arquitectónica se puede aplicar a almacenes de modelos y repositorios de paquetes. El objetivo es hacer explícitos el origen, la versión y la aprobación de los artefactos en lugar de copiar archivos aleatorios manualmente a cada servidor.",{},{"id":630,"data":631,"type":42,"tunes":633},"h-rag",{"text":632,"level":253},"RAG puede funcionar completamente con aislamiento de red",{},{"id":635,"data":636,"type":218,"tunes":638},"p-rag-1",{"text":637},"RAG no requiere internet público. Requiere un corpus recuperable, una canalización de ingesta\u002Findexación y un modelo que pueda usar el contexto recuperado.",{},{"id":640,"data":641,"type":218,"tunes":643},"p-rag-2",{"text":642},"Dentro de un entorno con aislamiento de red, el almacén de documentos, el analizador\u002FOCR, el modelo de embedding, el índice vectorial o léxico, el reranker y el modelo de generación pueden ejecutarse localmente.",{},{"id":645,"data":646,"type":218,"tunes":648},"p-rag-3",{"text":647},"Lo que cambia es la adquisición de fuentes. La búsqueda web en vivo y los conectores de documentos en la nube no están disponibles a menos que se importen datos equivalentes a través del límite controlado.",{},{"id":650,"data":651,"type":218,"tunes":653},"p-rag-4",{"text":652},"Por lo tanto, el corpus se convierte en un artefacto gobernado. Cada importación debe preservar la identidad de la fuente, la fecha\u002Fversión y la procedencia para que los usuarios sepan qué conocimiento contiene realmente el sistema aislado.",{},{"id":655,"data":656,"type":661,"tunes":662},"ref-rag",{"url":657,"title":658,"excerpt":659,"ctaLabel":660},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works","¿Qué es RAG? La explicación más simple de cómo funciona","RAG en sí es independiente del alojamiento en la nube. En una arquitectura con aislamiento de red, la recuperación y la generación simplemente deben ser proporcionadas por componentes locales\u002Finternos.","Leer los fundamentos de RAG","referralArticle",{},{"id":664,"data":665,"type":42,"tunes":667},"h-agents",{"text":666,"level":253},"Los agentes pueden ejecutarse con aislamiento de red, pero solo con herramientas accesibles",{},{"id":669,"data":670,"type":218,"tunes":672},"p-agents-1",{"text":671},"Un bucle de agente puede ejecutarse completamente dentro de un enclave aislado si el modelo\u002Fentorno de ejecución y las herramientas requeridas son locales o accesibles en la red interna.",{},{"id":674,"data":675,"type":218,"tunes":677},"p-agents-2",{"text":676},"Una herramienta que depende de GitHub, búsqueda web pública, correo electrónico en la nube o una API de SaaS externa fallará a menos que la arquitectura proporcione un equivalente interno aprobado o un proceso de intercambio asíncrono controlado.",{},{"id":679,"data":680,"type":218,"tunes":682},"p-agents-3",{"text":681},"Por eso el diseño de agentes con aislamiento de red debe comenzar con un inventario de capacidades: cada punto de conexión de herramienta debe clasificarse como interno, importado, no disponible o deliberadamente excluido.",{},{"id":684,"data":685,"type":42,"tunes":687},"h-mcp",{"text":686,"level":253},"MCP no elude el aislamiento de red",{},{"id":689,"data":690,"type":218,"tunes":692},"p-mcp-1",{"text":691},"MCP puede exponer herramientas y recursos locales dentro de un entorno de IA aislado, pero el protocolo no crea conectividad a través del límite de seguridad.",{},{"id":694,"data":695,"type":218,"tunes":697},"p-mcp-2",{"text":696},"Un servidor MCP local que lee documentos internos puede funcionar perfectamente sin conexión. No se puede acceder a un servidor MCP remoto en la internet pública desde un enclave estrictamente aislado.",{},{"id":699,"data":700,"type":218,"tunes":702},"p-mcp-3",{"text":701},"El mismo principio se aplica a cualquier protocolo de conector: la interoperabilidad es independiente de la autoridad de red.",{},{"id":704,"data":705,"type":42,"tunes":707},"h-identity",{"text":706,"level":253},"La identidad y la autenticación también deben funcionar sin conexión",{},{"id":709,"data":710,"type":218,"tunes":712},"p-id-1",{"text":711},"Una aplicación de IA puede alojarse localmente y aun así depender de un proveedor de identidad en la nube. Esa dependencia oculta rompe el funcionamiento verdaderamente desconectado.",{},{"id":714,"data":715,"type":218,"tunes":717},"p-id-2",{"text":716},"Por lo tanto, los diseños con aislamiento de red necesitan una arquitectura de identidad que funcione dentro del enclave: directorio local, proveedor de identidad interno, PKI interna, credenciales de servicio locales u otro mecanismo aprobado.",{},{"id":719,"data":720,"type":218,"tunes":722},"p-id-3",{"text":721},"La autorización sigue siendo necesaria aunque no haya internet. Los aislamientos de red no reemplazan RBAC, el aislamiento de inquilinos ni el privilegio mínimo.",{},{"id":724,"data":725,"type":42,"tunes":727},"h-time",{"text":726,"level":253},"El tiempo, los certificados y los almacenes de confianza se convierten en dependencias locales",{},{"id":729,"data":730,"type":218,"tunes":732},"p-time-1",{"text":731},"Muchos sistemas de autenticación y registro dependen de una hora fiable. Los certificados caducan. Los almacenes de confianza cambian. Los artefactos firmados necesitan validación.",{},{"id":734,"data":735,"type":218,"tunes":737},"p-time-2",{"text":736},"Por lo tanto, un enclave desconectado debe tener sincronización horaria interna y un ciclo de vida de certificados\u002Fconfianza que no dependa de alcanzar servicios públicos durante la operación ordinaria.",{},{"id":739,"data":740,"type":218,"tunes":742},"p-time-3",{"text":741},"Estas son preocupaciones de infraestructura ordinarias que se vuelven visibles solo cuando se prueba una arquitectura sin acceso a internet.",{},{"id":744,"data":745,"type":42,"tunes":747},"h-telemetry",{"text":746,"level":253},"La telemetría y los informes de fallos necesitan una política explícita",{},{"id":749,"data":750,"type":218,"tunes":752},"p-tel-1",{"text":751},"Muchas bibliotecas modernas intentan realizar análisis, comprobaciones de actualizaciones o informes de errores de forma predeterminada.",{},{"id":754,"data":755,"type":218,"tunes":757},"p-tel-2",{"text":756},"En un entorno aislado, esas llamadas deberían deshabilitarse o redirigirse a la observabilidad interna. Los intentos fallidos repetidos de telemetría pueden crear retrasos, registros ruidosos y un comportamiento de inicio inesperado.",{},{"id":759,"data":760,"type":218,"tunes":762},"p-tel-3",{"text":761},"Un despliegue con aislamiento de red debe saber qué componentes intentan salir a la red, incluso si el cortafuegos los bloqueara.",{},{"id":764,"data":765,"type":42,"tunes":767},"h-updates",{"text":766,"level":253},"Los sistemas con aislamiento de red siguen necesitando parches",{},{"id":769,"data":770,"type":218,"tunes":772},"p-update-1",{"text":771},"El aislamiento de red no impide que el software desarrolle vulnerabilidades. Solo cambia la forma en que los parches llegan al sistema.",{},{"id":774,"data":775,"type":218,"tunes":777},"p-update-2",{"text":776},"NIST enmarca la gestión de parches como mantenimiento preventivo: las organizaciones aún necesitan identificar, adquirir, priorizar, instalar y verificar parches y actualizaciones.",{},{"id":779,"data":780,"type":218,"tunes":782},"p-update-3",{"text":781},"Por lo tanto, las operaciones con aislamiento de red necesitan una cadencia de importación repetible para paquetes del sistema operativo, imágenes de contenedores, controladores, entornos de ejecución de IA y actualizaciones de seguridad. La disyuntiva está entre la estabilidad del aislamiento y la exposición a vulnerabilidades por software desactualizado.",{},{"id":784,"data":785,"type":42,"tunes":787},"h-patch-flow",{"text":786,"level":253},"Una ruta de actualización controlada",{},{"id":789,"data":790,"type":331,"tunes":817},"patch-flow",{"steps":791,"title":816,"orientation":330},[792,795,798,801,804,807,810,813],{"label":793,"description":794},"1. Identificar la actualización requerida","Un aviso de seguridad, una mejora del modelo o del entorno de ejecución, o una necesidad operativa desencadena el cambio.",{"label":796,"description":797},"2. Adquirir en un entorno de preparación conectado","Descargar las versiones exactas junto con firmas\u002Fsumas de verificación y metadatos.",{"label":799,"description":800},"3. Validar la evidencia de la cadena de suministro","Verificar el origen, la integridad, la compatibilidad y los requisitos de política.",{"label":802,"description":803},"4. Probar en un entorno de preparación offline representativo","Confirmar que la actualización funciona sin dependencias de red inesperadas.",{"label":805,"description":806},"5. Aprobar la transferencia","Aplicar el proceso de cambio y seguridad de la organización.",{"label":808,"description":809},"6. Importar al repositorio del enclave","Publicar el artefacto en la fuente interna de confianza.",{"label":811,"description":812},"7. Desplegar gradualmente","Aplicar a nodos de prueba\u002Fcanario antes de un despliegue más amplio donde la arquitectura lo permita.",{"label":814,"description":815},"8. Verificar y registrar","Confirmar la versión, el estado, el comportamiento y el estado de reversión.","Ejemplo de ciclo de vida de actualización para un entorno de IA aislado",{},{"id":819,"data":820,"type":42,"tunes":822},"h-transfer",{"text":821,"level":253},"La frontera de transferencia es la interfaz operativa más sensible",{},{"id":824,"data":825,"type":218,"tunes":827},"p-transfer-1",{"text":826},"Si información externa debe entrar en un sistema con aislamiento de red, el canal de importación se convierte en un punto de control de seguridad importante.",{},{"id":829,"data":830,"type":218,"tunes":832},"p-transfer-2",{"text":831},"El Marco de Amenazas Cibernéticas Técnicas de Ciberseguridad de la NSA reconoce explícitamente la replicación a través de medios extraíbles como una vía que los adversarios pueden usar para cruzar hacia redes desconectadas o con aislamiento de red.",{},{"id":834,"data":835,"type":218,"tunes":837},"p-transfer-3",{"text":836},"Por eso, el manejo controlado de medios, la inspección, la procedencia, el cifrado cuando sea necesario, el análisis de malware y la separación de roles pueden importar tanto como la propia pila de IA.",{},{"id":839,"data":840,"type":42,"tunes":842},"h-media",{"text":841,"level":253},"Los medios extraíbles no son un conducto neutral",{},{"id":844,"data":845,"type":218,"tunes":847},"p-media-1",{"text":846},"Las unidades USB y otros medios portátiles pueden contener tanto artefactos legítimos de modelos\u002Fdatos como contenido malicioso.",{},{"id":849,"data":850,"type":218,"tunes":852},"p-media-2",{"text":851},"La guía de sanitización de medios de NIST trata los medios de almacenamiento como un objeto del ciclo de vida de la confidencialidad que puede requerir borrado, purga o destrucción según la sensibilidad y las necesidades de reutilización.",{},{"id":854,"data":855,"type":218,"tunes":857},"p-media-3",{"text":856},"El procedimiento exacto de transferencia es específico de cada organización, pero el principio arquitectónico es estable: los medios que cruzan fronteras deben gobernarse como un activo de seguridad, no tratarse como una conveniencia informal.",{},{"id":859,"data":860,"type":42,"tunes":862},"h-supply",{"text":861,"level":253},"El aislamiento de red aumenta la importancia de la cadena de suministro",{},{"id":864,"data":865,"type":218,"tunes":867},"p-supply-1",{"text":866},"Un sistema aislado recibe menos entradas externas activas, pero cada binario, modelo, contenedor y paquete importado adquiere mayor relevancia porque el enclave puede confiar en él durante mucho tiempo.",{},{"id":869,"data":870,"type":218,"tunes":872},"p-supply-2",{"text":871},"La guía de NIST sobre la cadena de suministro de software enfatiza la procedencia, el riesgo del proveedor, la gestión de vulnerabilidades, la verificación de software y las prácticas orientadas a SBOM. Estas preocupaciones se vuelven directamente relevantes para la importación de artefactos de IA sin conexión.",{},{"id":874,"data":875,"type":218,"tunes":877},"p-supply-3",{"text":876},"La cadena de suministro de modelos merece la misma atención que la cadena de suministro de aplicaciones: el origen del modelo, la licencia, el hash, el formato, el código requerido, el tokenizador, los adaptadores y el estado de evaluación deben conocerse antes de la importación.",{},{"id":879,"data":880,"type":42,"tunes":882},"h-readiness",{"text":881,"level":253},"La preparación para el air-gap debe probarse, no asumirse",{},{"id":884,"data":885,"type":226,"tunes":888},"readiness-note",{"body":886,"title":887,"variant":246},"La siguiente prueba de preparación para el air-gap es una síntesis de ingeniería, no un método de certificación de NIST ni de un proveedor. Está diseñada para exponer dependencias externas ocultas antes del despliegue.","Patrón de validación propuesto",{},{"id":890,"data":891,"type":394,"tunes":926},"readiness-table",{"content":892,"stretched":43,"withHeadings":14},[893,896,899,902,905,908,911,914,917,920,923],[894,895],"Prueba","Qué demuestra",[897,898],"Arranque en frío con toda la red saliente bloqueada","El entorno de ejecución no requiere servicios públicos durante el arranque",[900,901],"Cargar cada modelo aprobado desde el almacenamiento local","Los pesos\u002Ftokenizadores\u002Fconfiguraciones están completos",[903,904],"Reconstruir\u002Fredesplegar solo desde registros internos","Los espejos de contenedores\u002Fpaquetes son suficientes",[906,907],"Autenticar usuarios mientras el IdP externo es inalcanzable","La identidad funciona dentro del enclave",[909,910],"Ejecutar la ingesta y consulta de RAG sin conexión","La pila de embedding\u002Findexación\u002Frecuperación es local",[912,913],"Ejecutar herramientas de agente representativas","Las herramientas no dependen de API externas",[915,916],"Reiniciar tras eliminar la caché","La operación sin conexión no depende accidentalmente de descargas previamente almacenadas en caché",[918,919],"Avanzar el ciclo de vida simulado de certificados\u002Factualizaciones","Las dependencias de confianza y mantenimiento se comprenden",[921,922],"Importar un nuevo modelo a través de la ruta de preparación","El procedimiento de transferencia\u002Fcambio es operativo",[924,925],"Restaurar desde copia de seguridad","La recuperación no requiere almacenamiento en la nube no disponible",{},{"id":928,"data":929,"type":42,"tunes":931},"h-cache",{"text":930,"level":253},"Almacenado en caché una vez no es lo mismo que listo para air-gap",{},{"id":933,"data":934,"type":218,"tunes":936},"p-cache-1",{"text":935},"Un sistema puede parecer sin conexión porque el modelo y los paquetes ya están en caché de un acceso previo a internet.",{},{"id":938,"data":939,"type":218,"tunes":941},"p-cache-2",{"text":940},"Eliminar las cachés o desplegar en un nodo limpio puede revelar archivos de tokenizador faltantes, paquetes de Python, manifiestos de modelos o dependencias de código remoto.",{},{"id":943,"data":944,"type":218,"tunes":946},"p-cache-3",{"text":945},"Por lo tanto, la preparación para el air-gap debe validarse a partir de artefactos internos limpios, no solo desde una estación de trabajo de desarrollador que estuvo conectada previamente.",{},{"id":948,"data":949,"type":42,"tunes":951},"h-threats",{"text":950,"level":253},"¿Qué amenazas permanecen dentro de un air gap?",{},{"id":953,"data":954,"type":394,"tunes":995},"threat-table",{"content":955,"stretched":43,"withHeadings":14},[956,959,962,965,968,971,974,977,980,983,986,989,992],[957,958],"Amenaza","Por qué el air gap no la elimina",[960,961],"Artefacto importado comprometido","El malware\u002Fmodelo\u002Fpaquete puede entrar a través de la ruta de transferencia autorizada",[963,964],"Medios extraíbles maliciosos","La transferencia física puede transportar cargas útiles ejecutables",[966,967],"Uso indebido por parte de personas internas","Ya existen usuarios autorizados dentro del enclave",[969,970],"Inyección de prompts en documentos importados","El contenido no confiable puede influir en RAG\u002Fagentes sin internet",[972,973],"Herramientas de agente con privilegios excesivos","Las herramientas locales aún pueden dañar sistemas locales",[975,976],"Fuga de datos entre inquilinos","Los errores de autorización internos siguen siendo posibles",[978,979],"Software interno vulnerable","La falta de conexión externa no elimina errores explotables",[981,982],"Movimiento lateral","Un nodo comprometido puede atacar otros nodos conectados internamente",[984,985],"Dependencias obsoletas","Una cadencia de actualización lenta puede dejar vulnerabilidades conocidas sin parchear",[987,988],"Robo\u002Fmanipulación física","La seguridad del hardware y los medios sigue siendo crítica",[990,991],"Mal comportamiento del modelo","La alucinación, el sesgo y el fallo de tareas son independientes de la red",[993,994],"Envenenamiento de la cadena de suministro","Las fuentes de importación confiables aún pueden verse comprometidas",{},{"id":997,"data":998,"type":42,"tunes":1000},"h-benefits",{"text":999,"level":253},"Qué mejora realmente un air gap",{},{"id":1002,"data":1003,"type":218,"tunes":1005},"p-benefit-1",{"text":1004},"Un air gap genuino puede reducir materialmente las rutas de ataque que dependen de la conectividad remota directa: comando y control externo, uso indebido de credenciales en la nube, explotación de servicios expuestos a internet y exfiltración accidental de datos a través de API salientes ordinarias.",{},{"id":1007,"data":1008,"type":218,"tunes":1010},"p-benefit-2",{"text":1009},"También simplifica la residencia de datos en un sentido limitado: los datos de inferencia no pueden enviarse a un servicio en la nube externo si no existe una ruta.",{},{"id":1012,"data":1013,"type":218,"tunes":1015},"p-benefit-3",{"text":1014},"Esos beneficios son más fuertes cuando el límite de transferencia y los controles de acceso internos son igualmente disciplinados. Un proceso de USB mal gestionado puede socavar el aislamiento previsto.",{},{"id":1017,"data":1018,"type":42,"tunes":1020},"h-costs",{"text":1019,"level":253},"Qué dificulta un air gap",{},{"id":1022,"data":1023,"type":394,"tunes":1064},"cost-table",{"content":1024,"stretched":43,"withHeadings":14},[1025,1028,1031,1034,1037,1040,1043,1046,1049,1052,1055,1058,1061],[1026,1027],"Área","Consecuencia operativa",[1029,1030],"Actualizaciones de modelos","Transferencia manual\u002Fpor etapas en lugar de extracción directa del centro de modelos",[1032,1033],"Parches de seguridad","Flujo de trabajo de importación retrasado y gobernado",[1035,1036],"Instalación de paquetes","Se requieren espejos internos o artefactos preconstruidos",[1038,1039],"API de IA en la nube","No disponibles",[1041,1042],"Búsqueda web\u002Fconectores","No disponibles a menos que los datos se importen por separado",[1044,1045],"Autenticación","Necesita servicios de identidad internos o con capacidad sin conexión",[1047,1048],"Monitoreo","Necesita observabilidad interna y exportación controlada",[1050,1051],"Licencias","Los productos que requieren activación en línea pueden no ser adecuados",[1053,1054],"Solución de problemas","No hay acceso en vivo fácil a recursos del proveedor desde el enclave de producción",[1056,1057],"Capacidad","Todo el cómputo de inferencia debe existir localmente",[1059,1060],"Recuperación ante desastres","Las copias de seguridad en la nube pueden no estar disponibles o estar restringidas por políticas",[1062,1063],"Actualidad del conocimiento","La información externa llega solo tan rápido como el proceso de importación",{},{"id":1066,"data":1067,"type":42,"tunes":1069},"h-private",{"text":1068,"level":253},"IA con aislamiento físico vs IA privada",{},{"id":1071,"data":1072,"type":218,"tunes":1074},"p-private-1",{"text":1073},"La IA privada se centra principalmente en controlar los datos sensibles y el procesamiento de IA. Una plataforma de IA privada puede estar en las instalaciones y aun así acceder a modelos en la nube aprobados o a servicios externos.",{},{"id":1076,"data":1077,"type":218,"tunes":1079},"p-private-2",{"text":1078},"La IA con aislamiento físico es más estricta en cuanto a la conectividad. Un sistema puede ser privado sin estar aislado físicamente, y un sistema aislado físicamente puede seguir teniendo una privacidad deficiente si todos los usuarios internos tienen acceso sin restricciones.",{},{"id":1081,"data":1082,"type":218,"tunes":1084},"p-private-3",{"text":1083},"El objetivo de seguridad debe determinar la arquitectura: la confidencialidad, la soberanía, la resiliencia y el aislamiento son requisitos relacionados pero distintos.",{},{"id":1086,"data":1087,"type":42,"tunes":1089},"h-sovereign",{"text":1088,"level":253},"IA con aislamiento físico vs IA soberana",{},{"id":1091,"data":1092,"type":218,"tunes":1094},"p-sovereign-1",{"text":1093},"La IA soberana se refiere al control sobre la cadena de dependencias más amplia: datos, modelos, infraestructura, operadores, jurisdicción y dependencias estratégicas.",{},{"id":1096,"data":1097,"type":218,"tunes":1099},"p-sovereign-2",{"text":1098},"Un aislamiento físico puede respaldar la soberanía al reducir la dependencia externa en tiempo de ejecución, pero no garantiza el control soberano. El enclave puede seguir dependiendo de hardware extranjero, licencias de modelos propietarios o proveedores externos de actualizaciones.",{},{"id":1101,"data":1102,"type":218,"tunes":1104},"p-sovereign-3",{"text":1103},"El siguiente artículo canónico separa esas dimensiones de control de forma explícita.",{},{"id":1106,"data":1107,"type":42,"tunes":1109},"h-implementation",{"text":1108,"level":253},"Evidencia de la implementación original: qué demuestra el Aaasaasa AI Client y qué no",{},{"id":1111,"data":1112,"type":226,"tunes":1115},"impl-note",{"body":1113,"title":1114,"variant":246},"Aaasaasa AI Client es evidencia útil para la \u003Cstrong>arquitectura de inferencia local\u003C\u002Fstrong>, la abstracción de proveedores y la separación de la ubicación del entorno de ejecución y del modelo. \u003Cstrong>No es evidencia de un entorno con aislamiento físico desplegado\u003C\u002Fstrong>. El repositorio también admite rutas en la nube y remotas, y ninguna evidencia verificada del proyecto establece un dominio de seguridad físicamente aislado.","Límite de implementación",{},{"id":1117,"data":1118,"type":218,"tunes":1120},"p-impl-1",{"text":1119},"El AI Hub separa el agente\u002Fcliente, el proveedor, el modelo y la ubicación de la conexión. Admite la inferencia local con Ollama y la operación de Codex con proveedor local como opciones distintas, en lugar de asumir que todas las solicitudes de IA van a un modelo en la nube.",{},{"id":1122,"data":1123,"type":218,"tunes":1125},"p-impl-2",{"text":1124},"El repositorio señala explícitamente que un entorno de ejecución local puede seguir usando un modelo en la nube, mientras que el chat directo con Ollama es inferencia local. Esta distinción es directamente relevante para la arquitectura de aislamiento físico: la ejecución local no demuestra que el modelo o las dependencias que lo rodean estén desconectados.",{},{"id":1127,"data":1128,"type":218,"tunes":1130},"p-impl-3",{"text":1129},"La abstracción de proveedores, el descubrimiento de modelos locales y la inferencia local son, por lo tanto, componentes básicos para una arquitectura de producto capaz de soportar aislamiento físico, pero el límite de red, el espejo de dependencias sin conexión, el proceso de transferencia controlada y la identidad\u002Foperaciones sin conexión aún deben diseñarse por separado.",{},{"id":1132,"data":1133,"type":394,"tunes":1156},"impl-table",{"content":1134,"stretched":43,"withHeadings":14},[1135,1138,1141,1144,1147,1150,1153],[1136,1137],"Capacidad verificada del proyecto","Relevancia para el aislamiento físico",[1139,1140],"Inferencia local con Ollama","Admite la ejecución local de modelos",[1142,1143],"Rutas de proveedor\u002Fentorno de ejecución local","Reduce la dependencia de la inferencia en la nube",[1145,1146],"Separación de proveedor\u002Fmodelo\u002Fentorno de ejecución","Hace explícitas las dependencias de la nube en lugar de ocultarlas",[1148,1149],"Permisos centrales","Admite el control de acceso local a herramientas y datos",[1151,1152],"También existe soporte para proveedores en la nube\u002Fremotos","Demuestra que el producto en sí es capaz de funcionar de forma híbrida, no inherentemente con aislamiento físico",[1154,1155],"No hay un límite de despliegue aislado verificado","Evita exagerar la madurez del aislamiento físico",{},{"id":1158,"data":1159,"type":42,"tunes":1161},"h-when",{"text":1160,"level":253},"¿Cuándo está justificada la IA con aislamiento físico?",{},{"id":1163,"data":1164,"type":394,"tunes":1187},"when-table",{"content":1165,"stretched":43,"withHeadings":14},[1166,1169,1172,1175,1178,1181,1184],[1167,1168],"El aislamiento físico puede estar justificado cuando","Una arquitectura privada conectada puede ser mejor cuando",[1170,1171],"La política de seguridad exige explícitamente dominios físicamente separados","El requisito principal es solo que los prompts y los datos no sean utilizados por servicios de consumo públicos",[1173,1174],"Los datos clasificados o extremadamente sensibles no pueden cruzar redes externas","Los endpoints aprobados de nube empresarial o privados satisfacen los controles de datos",[1176,1177],"El entorno operativo no tiene conectividad externa fiable","Hay internet disponible y la agilidad operativa es importante",[1179,1180],"La continuidad de la misión no debe depender de la disponibilidad de la nube o del proveedor","La calidad gestionada del modelo y las actualizaciones rápidas son más valiosas",[1182,1183],"Un entorno regulado o crítico exige una transferencia controlada","Los controles de seguridad estándar pueden satisfacer el modelo de amenaza real",[1185,1186],"El acceso externo a SaaS o API está prohibido","El flujo de trabajo empresarial depende en gran medida de conectores externos",{},{"id":1189,"data":1190,"type":218,"tunes":1192},"p-when-1",{"text":1191},"El aislamiento físico debe ser un requisito derivado de un modelo de amenaza o de una política, no una característica de prestigio. Tiene valor de seguridad real cuando la ruta de conectividad eliminada es en sí misma inaceptable.",{},{"id":1194,"data":1195,"type":218,"tunes":1197},"p-when-2",{"text":1196},"Para muchos casos de uso empresariales, una red privada estrictamente controlada con restricciones de salida, inferencia local y canales de actualización aprobados puede ofrecer un mejor equilibrio entre seguridad y mantenibilidad que un aislamiento físico estricto.",{},{"id":1199,"data":1200,"type":42,"tunes":1202},"h-design",{"text":1201,"level":253},"Una secuencia práctica de diseño de IA con air gap",{},{"id":1204,"data":1205,"type":331,"tunes":1244},"design-flow",{"steps":1206,"title":1243,"orientation":330},[1207,1210,1213,1216,1219,1222,1225,1228,1231,1234,1237,1240],{"label":1208,"description":1209},"1. Definir qué separa el air gap","Nombrar los dominios de seguridad y si el requisito es separación física estricta o simplemente sin internet.",{"label":1211,"description":1212},"2. Inventariar cada dependencia externa","Modelos, paquetes, registros, identidad, telemetría, licencias, almacenamiento, APIs, DNS\u002Ftiempo y servicios de soporte.",{"label":1214,"description":1215},"3. Seleccionar modelos y runtimes con capacidad offline","Verificar que los activos del modelo y el código del runtime puedan cargarse sin llamadas remotas.",{"label":1217,"description":1218},"4. Construir repositorios internos de artefactos","Crear fuentes confiables para contenedores, paquetes, modelos y actualizaciones.",{"label":1220,"description":1221},"5. Diseñar la transferencia controlada","Definir preparación, verificación, manejo de medios\u002Fpasarela, aprobación y procedencia.",{"label":1223,"description":1224},"6. Construir identidad y autorización internas","Asegurar que usuarios, servicios y herramientas puedan autenticarse sin dependencias de nube.",{"label":1226,"description":1227},"7. Mantener RAG y herramientas locales","Desplegar conocimiento, embeddings, índices y APIs de servicio requeridas dentro del enclave.",{"label":1229,"description":1230},"8. Construir observabilidad interna","Operar registros, métricas, trazas y monitoreo de seguridad localmente.",{"label":1232,"description":1233},"9. Definir la cadencia de parches\u002Factualizaciones de modelos","Equilibrar la respuesta a vulnerabilidades con el proceso de importación controlada.",{"label":1235,"description":1236},"10. Probar desde un estado limpio y desconectado","Arrancar en frío y operar sin cachés heredadas ni acceso a internet oculto.",{"label":1238,"description":1239},"11. Probar rutas de compromiso","Ejercitar escenarios de medios extraíbles, cadena de suministro, inyección de prompts, insider y movimiento lateral.",{"label":1241,"description":1242},"12. Documentar excepciones y exportaciones","Cada ruta permitida a través del límite debe tener un propósito, propietario y conjunto de controles nombrados.","Diseñar desde el límite hacia adentro",{},{"id":1246,"data":1247,"type":42,"tunes":1249},"h-checklist",{"text":1248,"level":253},"Lista de verificación de arquitectura de IA con air gap",{},{"id":1251,"data":1252,"type":394,"tunes":1305},"checklist-table",{"content":1253,"stretched":43,"withHeadings":14},[1254,1257,1260,1263,1266,1269,1272,1275,1278,1281,1284,1287,1290,1293,1296,1299,1302],[1255,1256],"Pregunta","Evidencia esperada",[1258,1259],"¿Qué exactamente está aislado de qué?","Límite de dominio de seguridad documentado",[1261,1262],"¿El límite está físicamente desconectado?","Evidencia de arquitectura de red\u002Ffísica si se afirma un air gap estricto",[1264,1265],"¿Cómo cruzan los datos el límite?","Flujo de trabajo desconectado autorizado no automatizado\u002Fmanual o explícitamente documentado",[1267,1268],"¿Puede cada modelo arrancar en frío offline?","Prueba de carga offline",[1270,1271],"¿Están completos los activos de tokenizer\u002Fconfig\u002Fruntime?","Paquete de modelo interno verificado",[1273,1274],"¿De dónde vienen los contenedores\u002Fpaquetes?","Espejo\u002Frepositorio interno confiable",[1276,1277],"¿Puede la identidad funcionar sin servicios de nube?","Ruta de credenciales de servicio\u002FIdP\u002FPKI interna",[1279,1280],"¿Puede RAG ingerir\u002Fconsultar offline?","Ingesta, embeddings, índice y recuperación locales",[1282,1283],"¿Qué herramientas de agente permanecen disponibles?","Inventario de capacidades internas",[1285,1286],"¿Cómo se importan los parches?","Proceso de mantenimiento controlado",[1288,1289],"¿Cómo se verifican los artefactos?","Controles de integridad\u002Fprocedencia\u002Fmalware\u002Fcadena de suministro",[1291,1292],"¿Cómo se gobiernan los medios extraíbles?","Política de manejo y sanitización de medios",[1294,1295],"¿Puede el sistema ejecutarse después de limpiar las cachés?","Prueba offline en entorno limpio",[1297,1298],"¿Dónde se almacenan los registros y trazas?","Plataforma de observabilidad interna",[1300,1301],"¿Cómo se aprueban las exportaciones?","Proceso de egreso controlado",[1303,1304],"¿Qué prueba que esto es air-gapped en lugar de meramente local?","Evidencia de límite y transferencia, no la ubicación del modelo",{},{"id":1307,"data":1308,"type":42,"tunes":1310},"h-failures",{"text":1309,"level":253},"Modos de fallo comunes de IA con air gap",{},{"id":1312,"data":1313,"type":394,"tunes":1354},"failure-table",{"content":1314,"stretched":43,"withHeadings":14},[1315,1318,1321,1324,1327,1330,1333,1336,1339,1342,1345,1348,1351],[1316,1317],"Modo de fallo","Qué falló realmente",[1319,1320],"El modelo local aún descarga tokenizer\u002Fconfig al iniciar","El paquete del modelo estaba incompleto",[1322,1323],"El contenedor hace referencia a un registro público","El despliegue no era autocontenido",[1325,1326],"Se requiere identidad en la nube para iniciar sesión","La aplicación era local pero la identidad no",[1328,1329],"Se requiere servidor de licencias externo","La dependencia del proveedor contradecía la operación offline",[1331,1332],"Falta el modelo de embeddings","El chat funciona pero la ingesta de RAG falla",[1334,1335],"Las llamadas de herramientas del agente van a SaaS público","La arquitectura del agente no era compatible con air gap",[1337,1338],"Solo el nodo GPU está aislado","La base de datos, UI o monitoreo aún dependen de servicios externos",[1340,1341],"Las importaciones por USB son informales","El límite de transferencia se convierte en una ruta de ataque no controlada",[1343,1344],"Sin proceso de parches","El aislamiento crea una deuda de vulnerabilidad creciente",[1346,1347],"Se usa una máquina de desarrollador con caché como prueba","El despliegue nuevo falla sin internet",[1349,1350],"El air gap reemplaza el pensamiento de autorización","Los usuarios\u002Fservicios internos se vuelven sobreprivilegiados",[1352,1353],"Se usa la etiqueta air-gapped para un bloqueo de egreso solo con firewall","La documentación de seguridad exagera el límite real",{},{"id":1356,"data":1357,"type":42,"tunes":1359},"h-misconceptions",{"text":1358,"level":253},"Conceptos erróneos comunes",{},{"id":1361,"data":1362,"type":394,"tunes":1397},"misconceptions-table",{"content":1363,"stretched":43,"withHeadings":14},[1364,1367,1370,1373,1376,1379,1382,1385,1388,1391,1394],[1365,1366],"Concepto erróneo","Corrección",[1368,1369],"“La IA local es IA con air gap.”","Local describe dónde se ejecuta la inferencia; air gap describe el límite de seguridad\u002Fred.",[1371,1372],"“Air-gapped significa una sola PC independiente.”","Un enclave aislado puede contener toda una red interna o clúster.",[1374,1375],"“Sin internet equivale a air gap estricto.”","Según la definición de NIST, los sistemas separados también carecen de conexión física y la transferencia a través del límite no es automatizada.",[1377,1378],"“Los air gaps eliminan el riesgo cibernético.”","Persisten riesgos de cadena de suministro, medios extraíbles, insider, red interna y aplicación.",[1380,1381],"“RAG necesita la nube.”","RAG puede ejecutarse completamente con modelos, índices y datos locales.",[1383,1384],"“Los agentes no pueden trabajar offline.”","Los agentes pueden usar herramientas internas\u002Flocales; simplemente no pueden alcanzar servicios externos no disponibles.",[1386,1387],"“Una vez instalado, el sistema no necesita actualizaciones.”","Los parches, controladores, modelos y dependencias aún requieren gestión del ciclo de vida.",[1389,1390],"“Un modelo descargado es autocontenido.”","Los tokenizers, código remoto, bibliotecas o activos del modelo aún pueden desencadenar dependencias de red.",[1392,1393],"“La IA privada y la IA con air gap son idénticas.”","La IA privada es una propiedad de datos\u002Fcontrol; el air gap es una propiedad de conectividad.",[1395,1396],"“El air gap garantiza la soberanía.”","El hardware externo, las licencias, los modelos y la cadena de suministro pueden seguir siendo dependencias.",{},{"id":1399,"data":1400,"type":42,"tunes":1402},"h-limitations",{"text":1401,"level":253},"Limitaciones",{},{"id":1404,"data":1405,"type":218,"tunes":1407},"p-limit-1",{"text":1406},"Los air gaps estrictos hacen más lenta la actualización del conocimiento externo porque cada nueva fuente debe pasar por un proceso de transferencia.",{},{"id":1409,"data":1410,"type":218,"tunes":1412},"p-limit-2",{"text":1411},"Pueden restringir la elección de modelos cuando las licencias, los requisitos de código remoto, las necesidades de hardware o las APIs exclusivas del proveedor no pueden satisfacerse offline.",{},{"id":1414,"data":1415,"type":218,"tunes":1417},"p-limit-3",{"text":1416},"Aumentan el costo operativo porque la infraestructura que normalmente se consume como servicios en la nube debe poseerse y mantenerse internamente.",{},{"id":1419,"data":1420,"type":218,"tunes":1422},"p-limit-4",{"text":1421},"También pueden crear latencia de parches: un control de cambios más estricto puede mantener los sistemas estables mientras retrasa la remediación urgente de vulnerabilidades.",{},{"id":1424,"data":1425,"type":218,"tunes":1427},"p-limit-5",{"text":1426},"Por lo tanto, la IA con air gap debe evaluarse como una arquitectura de seguridad entre varias, no asumirse como universalmente superior.",{},{"id":1429,"data":1430,"type":42,"tunes":1432},"h-change",{"text":1431,"level":253},"Qué cambiaría esta respuesta",{},{"id":1434,"data":1435,"type":218,"tunes":1437},"p-change-1",{"text":1436},"El soporte de proveedores para operación desconectada cambia rápidamente. Nuevos formatos de modelo, artefactos OCI firmados, mecanismos de licencia offline y registros de modelos integrados pueden reducir la fricción operativa.",{},{"id":1439,"data":1440,"type":218,"tunes":1442},"p-change-2",{"text":1441},"La distinción entre air gap estricto y despliegue desconectado seguirá siendo importante incluso si los proveedores continúan usando los términos de manera flexible.",{},{"id":1444,"data":1445,"type":218,"tunes":1447},"p-change-3",{"text":1446},"El principio estable es que las afirmaciones genuinas de air gap dependen del límite del sistema y del mecanismo de transferencia, no de si el LLM se ejecuta localmente.",{},{"id":1449,"data":1450,"type":42,"tunes":1452},"h-related",{"text":1451,"level":253},"Conocimiento canónico relacionado",{},{"id":1454,"data":1455,"type":218,"tunes":1457},"p-related-1",{"text":1456},"La IA con aislamiento físico es un nodo de arquitectura de despliegue\u002Fseguridad. La IA privada, la IA soberana y la abstracción de proveedores responden a preguntas diferentes sobre confidencialidad, control y dependencia.",{},{"id":1459,"data":1460,"type":218,"tunes":1462},"p-related-2",{"text":1461},"MLOps\u002FLLMOps se vuelve más exigente dentro de un entorno desconectado porque los ciclos de vida de modelos, paquetes y actualizaciones deben operar a través de repositorios internos y transferencia controlada.",{},{"id":1464,"data":1465,"type":218,"tunes":1467},"p-related-3",{"text":1466},"RAG y la IA agéntica siguen siendo patrones válidos dentro del enclave siempre que sus datos y herramientas estén disponibles internamente.",{},{"id":1469,"data":1470,"type":661,"tunes":1475},"ref-memory",{"url":1471,"title":1472,"excerpt":1473,"ctaLabel":1474},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","La memoria del agente de IA no es RAG: cómo separar memoria, recuperación, estado y contexto","La IA con aislamiento físico aún necesita límites internos correctos entre memoria duradera, estado autoritativo, recuperación y contexto del modelo.","Leer el artículo sobre arquitectura de memoria",{},{"id":1477,"data":1478,"type":42,"tunes":1480},"h-faq",{"text":1479,"level":253},"Preguntas frecuentes",{},{"id":1482,"data":1483,"type":1482,"tunes":1526},"faq",{"items":1484,"title":1525},[1485,1489,1493,1497,1501,1505,1509,1513,1517,1521],{"id":1486,"answer":1487,"question":1488},"faq1","La IA con aislamiento físico es IA desplegada dentro de un dominio de seguridad físicamente desconectado de los sistemas externos de los que está separada, con transferencia transfronteriza realizada mediante procedimientos controlados no automatizados bajo la definición estricta de NIST.","¿Qué es la IA con aislamiento físico?",{"id":1490,"answer":1491,"question":1492},"faq2","No para la inferencia y operación normales. Los modelos, paquetes, datos y servicios requeridos deben estar disponibles dentro del entorno aislado.","¿La IA con aislamiento físico necesita acceso a internet?",{"id":1494,"answer":1495,"question":1496},"faq3","No. Un modelo local puede ejecutarse en una máquina que aún tiene acceso a internet o utiliza identidad, herramientas o almacenamiento en la nube. El aislamiento físico describe el límite completo del sistema.","¿Un LLM local está automáticamente aislado físicamente?",{"id":1498,"answer":1499,"question":1500},"faq4","Sí. Los documentos, modelos de embedding, índices vectoriales o léxicos, rerankers y modelos de generación pueden ejecutarse localmente. El conocimiento externo debe importarse a través del límite controlado.","¿Puede funcionar RAG en una red con aislamiento físico?",{"id":1502,"answer":1503,"question":1504},"faq5","Sí, si sus herramientas y los sistemas requeridos están disponibles dentro de la red aislada. Las API de SaaS público y en la nube no están disponibles sin un mecanismo transfronterizo permitido.","¿Pueden funcionar los agentes de IA con aislamiento físico?",{"id":1506,"answer":1507,"question":1508},"faq6","Los modelos normalmente se adquieren y validan en un entorno de staging conectado, se transfieren mediante un proceso aprobado y se publican en un repositorio interno de modelos\u002Fartefactos.","¿Cómo se actualizan los modelos en un entorno con aislamiento físico?",{"id":1510,"answer":1511,"question":1512},"faq7","No. On-premises describe la ubicación de la infraestructura. Los sistemas on-prem pueden permanecer conectados a internet.","¿La IA on-premises es lo mismo que la IA con aislamiento físico?",{"id":1514,"answer":1515,"question":1516},"faq8","No. La IA privada trata sobre requisitos de datos\u002Fcontrol y aún puede usar infraestructura conectada. El aislamiento físico describe específicamente la separación de red\u002Fdominio.","¿La IA privada es lo mismo que la IA con aislamiento físico?",{"id":1518,"answer":1519,"question":1520},"faq9","Elimina o reduce algunos riesgos de conectividad remota, pero no elimina riesgos de cadena de suministro, medios extraíbles, amenazas internas, autorización interna, físicos o de comportamiento del modelo.","¿Un aislamiento físico hace que la IA sea segura?",{"id":1522,"answer":1523,"question":1524},"faq10","Desplegar o iniciar en frío todo el stack en un entorno limpio con toda la conectividad externa no disponible y verificar que los modelos, la identidad, RAG, las herramientas, el monitoreo, las actualizaciones y la recuperación dependan únicamente de artefactos y servicios internos aprobados.","¿Cuál es la mejor prueba para la preparación para el aislamiento físico?","Preguntas frecuentes sobre IA con aislamiento físico",{},{"id":1528,"data":1529,"type":42,"tunes":1531},"h-glossary",{"text":1530,"level":253},"Glosario",{},{"id":1533,"data":1534,"type":1533,"tunes":1582},"glossary",{"title":1535,"entries":1536},"Términos clave de IA con aislamiento físico",[1537,1541,1545,1548,1551,1554,1558,1562,1566,1570,1574,1578],{"term":1538,"anchor":1539,"definition":1540},"Aislamiento físico","air-gap","Interfaz de dominio de seguridad donde los sistemas no están físicamente conectados y cualquier transferencia lógica transfronteriza es no automatizada\u002Fmanual según la definición del glosario de NIST.",{"term":1542,"anchor":1543,"definition":1544},"IA con aislamiento físico","air-gapped-ai","Sistema de IA desplegado dentro de un dominio de seguridad con aislamiento físico con dependencias de inferencia y operativas disponibles localmente.",{"term":375,"anchor":1546,"definition":1547},"disconnected-environment","Entorno de despliegue sin acceso directo a internet externo; las implementaciones pueden usar flujos de trabajo controlados de espejo o bastión.",{"term":371,"anchor":1549,"definition":1550},"offline-capable-ai","Aplicación de IA capaz de operar para algunas o todas sus funciones sin conectividad a internet, sin estar necesariamente aislada de forma permanente.",{"term":367,"anchor":1552,"definition":1553},"local-ai","Inferencia o runtime de IA que se ejecuta en hardware local en lugar de un endpoint de modelo remoto; no implica aislamiento de red.",{"term":1555,"anchor":1556,"definition":1557},"Registro espejo","mirror-registry","Repositorio interno que contiene copias aprobadas de imágenes de contenedores u otros artefactos necesarios para un despliegue desconectado.",{"term":1559,"anchor":1560,"definition":1561},"Entorno de staging","staging-environment","Zona conectada o controlada donde los artefactos se adquieren, verifican y preparan antes de la transferencia a un dominio aislado.",{"term":1563,"anchor":1564,"definition":1565},"Transferencia controlada","controlled-transfer","Movimiento gobernado de datos o software a través del límite de aislamiento utilizando medios\u002Fprocesos aprobados y verificación.",{"term":1567,"anchor":1568,"definition":1569},"Procedencia de artefactos","artifact-provenance","Información que muestra de dónde proviene un modelo, paquete, contenedor u otro artefacto importado y cómo se produjo o verificó.",{"term":1571,"anchor":1572,"definition":1573},"Medios extraíbles","removable-media","Almacenamiento portátil utilizado para transferir datos entre sistemas; una posible vía de seguridad a través de dominios desconectados.",{"term":1575,"anchor":1576,"definition":1577},"Almacén interno de modelos","internal-model-store","Repositorio dentro del entorno aislado desde el cual se sirven o despliegan artefactos de modelos aprobados.",{"term":1579,"anchor":1580,"definition":1581},"Preparación para el aislamiento físico","air-gap-readiness","Capacidad demostrada de todo el stack de IA para instalarse, iniciarse, operar, actualizarse y recuperarse sin conectividad externa no aprobada.",{},{"id":1584,"data":1585,"type":42,"tunes":1587},"h-conclusion",{"text":1586,"level":253},"Conclusión",{},{"id":1589,"data":1590,"type":218,"tunes":1592},"p-conclusion-1",{"text":1591},"La IA con aislamiento físico no es un tipo especial de modelo. Es una arquitectura de IA que opera dentro de un dominio de seguridad deliberadamente aislado.",{},{"id":1594,"data":1595,"type":218,"tunes":1597},"p-conclusion-2",{"text":1596},"El modelo puede ser la parte fácil. La preparación para producción depende de si cada dependencia circundante — activos de modelos, paquetes, registros, identidad, RAG, herramientas, monitoreo, actualizaciones y recuperación — puede funcionar sin una ruta externa automatizada.",{},{"id":1599,"data":1600,"type":218,"tunes":1602},"p-conclusion-3",{"text":1601},"La regla confiable más breve es: la inferencia local demuestra dónde se ejecuta el modelo; la evidencia de aislamiento físico demuestra cómo se separa el sistema completo y cómo cada transferencia permitida cruza ese límite.",{},{"id":1604,"data":1605,"type":42,"tunes":1607},"h-sources",{"text":1606,"level":253},"Fuentes primarias y referencias de implementación actuales",{},{"id":1609,"data":1610,"type":218,"tunes":1612},"p-sources-note",{"text":1611},"Las fuentes a continuación establecen la definición de seguridad, los patrones actuales de despliegue de IA desconectada y los riesgos del ciclo de vida. El uso que hacen los proveedores de “air-gapped” se distingue intencionalmente de la definición más estricta de NIST.",{},{"id":1614,"data":1615,"type":1621,"tunes":1622},"src-nist-airgap",{"link":1616,"meta":1617},"https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fair_gap",{"image":1618,"title":1619,"description":1620},{"url":419},"NIST CSRC — Air gap","Definición del glosario de NIST: sistemas físicamente desconectados con transferencia lógica no automatizada y controlada manualmente a través del límite.","linkTool",{},{"id":1624,"data":1625,"type":1621,"tunes":1631},"src-nvidia-airgap",{"link":1626,"meta":1627},"https:\u002F\u002Fdocs.nvidia.com\u002Fnim\u002Flarge-language-models\u002Flatest\u002Fdeploy-air-gap.html",{"image":1628,"title":1629,"description":1630},{"url":419},"NVIDIA NIM — Despliegue con aislamiento físico","Guía operativa actual para preparar activos de modelos en un sistema conectado y ejecutar NIM desde almacenamiento local sin internet, registros públicos ni claves de API en la nube.",{},{"id":1633,"data":1634,"type":1621,"tunes":1640},"src-redhat-disconnected",{"link":1635,"meta":1636},"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Findex",{"image":1637,"title":1638,"description":1639},{"url":419},"Red Hat AI Inference — Despliegue desconectado","Guía actual de Red Hat para servir LLM en entornos desconectados con artefactos espejo e infraestructura interna.",{},{"id":1642,"data":1643,"type":1621,"tunes":1649},"src-redhat-models",{"link":1644,"meta":1645},"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Fstoring-models-in-disconnected-environments_disconnected-deploy",{"image":1646,"title":1647,"description":1648},{"url":419},"Red Hat AI Inference — Almacenamiento de modelos en entornos desconectados","Guía actual que cubre imágenes de modelos OCI, almacenamiento persistente de modelos y limitaciones de modelos que requieren código remoto.",{},{"id":1651,"data":1652,"type":1621,"tunes":1658},"src-nsa-framework",{"link":1653,"meta":1654},"https:\u002F\u002Fwww.nsa.gov\u002Fportals\u002F75\u002Fdocuments\u002Fwhat-we-do\u002Fcybersecurity\u002Fprofessional-resources\u002Fctr-nsa-css-technical-cyber-threat-framework.pdf",{"image":1655,"title":1656,"description":1657},{"url":419},"NSA — Marco técnico de amenazas cibernéticas","Marco de amenazas que identifica explícitamente la replicación mediante medios extraíbles como una vía de entrada a redes desconectadas o aisladas.",{},{"id":1660,"data":1661,"type":1621,"tunes":1667},"src-nist-media",{"link":1662,"meta":1663},"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fguidelines-media-sanitization",{"image":1664,"title":1665,"description":1666},{"url":419},"NIST SP 800-88 Rev. 1 — Directrices para el saneamiento de medios","Guía para gestionar y sanear medios de almacenamiento de acuerdo con los requisitos de confidencialidad de la información.",{},{"id":1669,"data":1670,"type":1621,"tunes":1676},"src-nist-patch",{"link":1671,"meta":1672},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F40\u002Fr4\u002Ffinal",{"image":1673,"title":1674,"description":1675},{"url":419},"NIST SP 800-40 Rev. 4 — Planificación de la gestión de parches empresarial","Guía que enmarca la aplicación de parches y actualizaciones como mantenimiento preventivo en sistemas empresariales.",{},{"id":1678,"data":1679,"type":1621,"tunes":1685},"src-nist-supply",{"link":1680,"meta":1681},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fexecutive-order-14028-improving-nations-cybersecurity\u002Fsoftware-security-supply-chains",{"image":1682,"title":1683,"description":1684},{"url":419},"NIST — Seguridad del software en las cadenas de suministro","Guía del NIST que cubre el riesgo de la cadena de suministro de software, la procedencia, la verificación, las prácticas relacionadas con SBOM y la gestión de vulnerabilidades.",{},"2.31","La IA con aislamiento de red ejecuta modelos, RAG y aplicaciones de IA dentro de un dominio de seguridad aislado sin dependencias de internet ni de la nube. Descubra cómo funcionan los modelos, los datos, las actualizaciones y las herramientas sin conexión.","\u002Fuploads\u002F2026\u002F10\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access-1791487983978-e6xqf0.webp","air-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access-1791487983978-e6xqf0","PUBLISHED","2026-10-08T11:32:00.000Z","2026-10-08T19:32:11.607Z","2026-10-08T21:37:26.788Z",{"en":1695,"de":1696,"sr":1697,"es":1698,"fr":1699,"it":1700,"ru":1701,"zh":1702},"\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fde\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fsr\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fes\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Ffr\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fit\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fru\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access","\u002Fzh\u002Fblog\u002Fair-gapped-ai-how-ai-systems-work-without-internet-or-cloud-access",[1704,1708,1712],{"id":1705,"name":1706,"slug":1707},57,"Límites de datos","data-boundaries",{"id":1709,"name":1710,"slug":1711},54,"Modelo de amenazas","threat-model",{"id":1713,"name":1714,"slug":1715},49,"Controles y evidencias","controls",{"id":1717,"login":1718,"email":1719,"displayName":1720},"20","rooth8233","aleksandar@stajic.de","Aleksandar Stajić",[1722,2980],{"lang":1723,"title":1724,"content":1725,"contentJson":1726,"excerpt":2979},"en","Air-Gapped AI: How AI Systems Work Without Internet or Cloud Access","{\"time\":1791495428517,\"blocks\":[{\"id\":\"intro\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped AI is an AI system deployed inside a security domain that has no physical network connection to the external systems it is separated from, with any transfer across that boundary performed through deliberately controlled, non-automated procedures. The AI model, runtime, data, retrieval indexes, tools and operational dependencies required for inference must therefore be available inside the isolated environment. Air-gapped AI is not simply “a local model” or “an on-premise server”: the defining property is the network and transfer boundary around the complete system.\"},\"tunes\":{}},{\"id\":\"direct\",\"type\":\"callout\",\"data\":{\"variant\":\"info\",\"title\":\"Direct answer\",\"body\":\"An air-gapped AI system can run LLM inference, RAG, document analysis and even agentic workflows without internet or cloud APIs if every required dependency is available inside the isolated domain.\u003Cbr>\u003Cbr>A practical architecture is:\u003Cbr>\u003Cstrong>controlled import → internal artifact\u002Fmodel repositories → local AI runtime → local data\u002FRAG → local tools → internal users\u002Fservices → local monitoring\u002Faudit\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>The difficult part is not making one LLM answer offline. It is operating the whole AI lifecycle — updates, models, drivers, packages, data imports, credentials, logging and security — without silently depending on external services.\"},\"tunes\":{}},{\"id\":\"nist-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Air gap has a stricter meaning than “no internet”\",\"body\":\"NIST's cybersecurity glossary defines an air gap as an interface where two systems are \u003Cstrong>not physically connected\u003C\u002Fstrong> and where any logical transfer is \u003Cstrong>not automated\u003C\u002Fstrong>; data crosses only manually under human control. Vendor documentation sometimes uses “air-gapped” or “disconnected” more broadly for environments with no outside-internet connection but with internal networking and controlled staging infrastructure. Architecture documentation should state which meaning is actually implemented.\"},\"tunes\":{}},{\"id\":\"not-security\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Air-gapped does not mean secure by definition\",\"body\":\"Removing direct network connectivity eliminates many remote paths, but it does not eliminate malicious removable media, compromised software\u002Fmodel imports, insider threats, vulnerable internal services, physical compromise, prompt injection through imported documents or lateral movement inside the isolated network.\"},\"tunes\":{}},{\"id\":\"current\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Current-source note — 8 October 2026\",\"body\":\"Current NVIDIA NIM and Red Hat AI Inference documentation both support LLM serving without outside-internet access by pre-staging model and container assets. NVIDIA documents a connected preparation phase followed by an isolated execution phase with local assets and no cloud registry credentials. Red Hat uses mirrored container\u002Fmodel repositories for disconnected OpenShift environments. These are useful implementation examples, but they do not override the stricter NIST definition of an air gap.\"},\"tunes\":{}},{\"id\":\"toc\",\"type\":\"tableOfContents\",\"data\":{\"title\":\"Contents\",\"minLevel\":2,\"maxLevel\":3},\"tunes\":{}},{\"id\":\"h-meaning\",\"type\":\"header\",\"data\":{\"text\":\"What air-gapped AI really means\",\"level\":2},\"tunes\":{}},{\"id\":\"p-meaning-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The word AI does not change the basic security concept. An air gap is a boundary between security domains. AI simply makes the isolated side more operationally demanding because modern AI stacks normally assume downloadable models, package registries, telemetry, APIs, model hubs and frequent software updates.\"},\"tunes\":{}},{\"id\":\"p-meaning-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The isolated environment can still contain many connected machines. An internal cluster may have GPUs, application servers, storage, databases, identity services and monitoring connected to each other. The air gap exists between that enclave and the outside domain.\"},\"tunes\":{}},{\"id\":\"p-meaning-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The relevant question is therefore not “Does this GPU have Wi-Fi?” but “Can this AI environment exchange information with the external domain through an automated physical or logical path?”\"},\"tunes\":{}},{\"id\":\"h-simple\",\"type\":\"header\",\"data\":{\"text\":\"The simplest example\",\"level\":2},\"tunes\":{}},{\"id\":\"p-simple-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Imagine a company wants an internal assistant for confidential technical documents, but the environment is not permitted to send those documents to the internet.\"},\"tunes\":{}},{\"id\":\"p-simple-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The company downloads an approved LLM, embedding model, container images and software packages in a connected staging environment. After validation, approved artifacts are transferred into the isolated environment.\"},\"tunes\":{}},{\"id\":\"p-simple-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Inside the enclave, the model server, document parser, vector database, application and identity services run locally. Users can ask questions and use RAG against internal documents without a cloud model or public model registry.\"},\"tunes\":{}},{\"id\":\"p-simple-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"When an update is required, the update passes through the controlled import process again rather than being downloaded directly by the production AI server.\"},\"tunes\":{}},{\"id\":\"simple-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"A basic air-gapped AI operating cycle\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Acquire outside the enclave\",\"description\":\"Download approved models, packages, containers, drivers, signatures and documentation in a connected staging environment.\"},{\"label\":\"2. Verify before transfer\",\"description\":\"Check provenance, signatures\u002Fchecksums, malware status, licensing and compatibility according to organizational policy.\"},{\"label\":\"3. Transfer through controlled boundary\",\"description\":\"Move approved artifacts using the authorized manual or mediated process.\"},{\"label\":\"4. Publish internally\",\"description\":\"Place artifacts in internal model, container, package or file repositories.\"},{\"label\":\"5. Deploy locally\",\"description\":\"Run inference, RAG, applications and tools without external dependencies.\"},{\"label\":\"6. Monitor inside the enclave\",\"description\":\"Collect logs, metrics, model\u002Fruntime status and security events locally.\"},{\"label\":\"7. Export only approved evidence\",\"description\":\"Move selected reports or artifacts outward through the reverse controlled process where policy permits.\"},{\"label\":\"8. Repeat for updates\",\"description\":\"Treat new models, patches, corpora and dependencies as new supply-chain imports.\"}]},\"tunes\":{}},{\"id\":\"h-stops\",\"type\":\"header\",\"data\":{\"text\":\"Where the simple example stops\",\"level\":2},\"tunes\":{}},{\"id\":\"p-stops-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A production air-gapped environment can be much larger than one workstation. It may include Kubernetes\u002FOpenShift, internal registries, object storage, identity providers, vector databases, observability, backup infrastructure and several model-serving nodes.\"},\"tunes\":{}},{\"id\":\"p-stops-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The more services exist inside the enclave, the more the organization must reproduce capabilities that connected environments normally consume from the internet.\"},\"tunes\":{}},{\"id\":\"p-stops-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapping therefore shifts complexity. It reduces direct external connectivity but increases artifact-management, patching, dependency, supply-chain and operational responsibility inside the isolated domain.\"},\"tunes\":{}},{\"id\":\"h-terms\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapped vs offline vs local vs on-premises vs private vs sovereign AI\",\"level\":2},\"tunes\":{}},{\"id\":\"terms-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Term\",\"What it primarily describes\",\"Internet\u002Fexternal connectivity required?\"],[\"Local AI\",\"Inference\u002Fruntime runs on local hardware\",\"No; but it may still call cloud services\"],[\"Offline-capable AI\",\"Can continue operating without internet\",\"No during offline operation; reconnection may be normal\"],[\"Disconnected environment\",\"No direct external-internet path from deployment environment\",\"Usually no; may use controlled mirrors\u002Fbastions\"],[\"On-premises AI\",\"Infrastructure runs in an organization's own\u002Fon-prem environment\",\"Could still have full internet connectivity\"],[\"Private AI\",\"AI processing is controlled to meet privacy\u002Fconfidentiality requirements\",\"Architecture-specific; can be connected or disconnected\"],[\"Air-gapped AI\",\"Security domains are physically disconnected and cross-boundary transfer is non-automated\u002Fmanual under strict definition\",\"No automated external path\"],[\"Sovereign AI\",\"Control\u002Fjurisdiction over models, data, infrastructure and dependencies\",\"Not necessarily; sovereignty is broader than network isolation\"]]},\"tunes\":{}},{\"id\":\"p-terms-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"These terms can overlap but are not synonyms. A local Ollama server connected to the internet is local AI, not air-gapped AI. An on-premises RAG platform that calls a cloud model is on-premises application infrastructure with cloud inference, not air-gapped AI.\"},\"tunes\":{}},{\"id\":\"p-terms-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"An air-gapped system is often private by design because data remains inside the enclave, but privacy also depends on authorization, logging, data handling, physical security and operational policy.\"},\"tunes\":{}},{\"id\":\"h-strict\",\"type\":\"header\",\"data\":{\"text\":\"Strict air gap vs practical disconnected deployment\",\"level\":2},\"tunes\":{}},{\"id\":\"strict-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"Two meanings frequently called “air-gapped”\",\"layout\":\"table\",\"columns\":[{\"id\":\"strict\",\"label\":\"Strict air gap\"},{\"id\":\"disconnected\",\"label\":\"Disconnected \u002F no-internet deployment\"}],\"rows\":[{\"id\":\"physical\",\"label\":\"External physical connection\",\"values\":{\"strict\":\"\",\"disconnected\":\"\"}},{\"id\":\"transfer\",\"label\":\"Cross-boundary transfer\",\"values\":{\"strict\":\"\",\"disconnected\":\"\"}},{\"id\":\"internet\",\"label\":\"Internet access from AI workload\",\"values\":{\"strict\":\"\",\"disconnected\":\"\"}},{\"id\":\"internalnet\",\"label\":\"Internal networking\",\"values\":{\"strict\":\"\",\"disconnected\":\"\"}},{\"id\":\"best\",\"label\":\"Use term when\",\"values\":{\"strict\":\"\",\"disconnected\":\"\"}}]},\"tunes\":{}},{\"id\":\"naming-rule\",\"type\":\"callout\",\"data\":{\"variant\":\"success\",\"title\":\"Document the boundary instead of relying on the label\",\"body\":\"For architecture and security reviews, write the actual rule: \u003Cstrong>no outbound internet\u003C\u002Fstrong>, \u003Cstrong>no physical external network path\u003C\u002Fstrong>, \u003Cstrong>manual transfer only\u003C\u002Fstrong>, or \u003Cstrong>disconnected cluster with approved bastion\u002Fmirror\u003C\u002Fstrong>. That is more precise than saying only “air-gapped.”\"},\"tunes\":{}},{\"id\":\"h-architecture\",\"type\":\"header\",\"data\":{\"text\":\"A practical air-gapped AI architecture\",\"level\":2},\"tunes\":{}},{\"id\":\"architecture-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Layer\",\"What must exist inside the isolated environment\"],[\"User\u002Fapplication layer\",\"Chat UI, APIs, business application or internal agent interface\"],[\"Identity & authorization\",\"Local\u002Finternal authentication, RBAC, tenant\u002Fresource permissions\"],[\"AI gateway\u002Fruntime\",\"Model routing, request policy, context assembly and runtime controls\"],[\"Model serving\",\"Local model server(s), weights, tokenizer\u002Fconfig and accelerator runtime\"],[\"RAG \u002F knowledge\",\"Document store, parser, embeddings, vector\u002Flexical indexes, metadata and provenance\"],[\"Tools\u002Fservices\",\"Only internal\u002Flocal APIs and approved systems reachable from the enclave\"],[\"Artifact repositories\",\"Local container registry, package mirror, model store and optionally OS\u002Fupdate repositories\"],[\"Observability\",\"Internal logs, metrics, traces and audit records\"],[\"Backup\u002Frecovery\",\"Local or separately controlled backup process appropriate to the security domain\"],[\"Transfer boundary\",\"Controlled import\u002Fexport process with inspection and approval\"]]},\"tunes\":{}},{\"id\":\"p-architecture-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A complete architecture should be able to start and operate without DNS lookups, license checks, package downloads or API calls to public services unless those dependencies have approved internal replacements.\"},\"tunes\":{}},{\"id\":\"p-architecture-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A useful design test is to disconnect the deployment from every external service and cold-start the stack. Hidden dependencies tend to appear during startup, model loading, authentication, package resolution or telemetry initialization.\"},\"tunes\":{}},{\"id\":\"h-models\",\"type\":\"header\",\"data\":{\"text\":\"Models must be pre-staged\",\"level\":2},\"tunes\":{}},{\"id\":\"p-models-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Cloud model APIs are unavailable by definition if the isolated workload has no path to them. The enclave therefore needs locally runnable model artifacts or an internally hosted inference service.\"},\"tunes\":{}},{\"id\":\"p-models-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NVIDIA's current NIM air-gap documentation explicitly uses a two-phase pattern: download and prepare model assets on a connected machine, transfer them, then run the isolated NIM from local storage without outbound registry access or cloud API keys.\"},\"tunes\":{}},{\"id\":\"p-models-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model weights are only part of the dependency set. Tokenizers, configuration files, adapters, quantization metadata and any required runtime code must also be present.\"},\"tunes\":{}},{\"id\":\"h-remote-code\",\"type\":\"header\",\"data\":{\"text\":\"Models with remote-code dependencies are an air-gap hazard\",\"level\":2},\"tunes\":{}},{\"id\":\"p-remote-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Some model repositories contain custom Python code or runtime hooks that normally fetch additional code or assets.\"},\"tunes\":{}},{\"id\":\"p-remote-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Current Red Hat AI Inference documentation explicitly warns that some Hugging Face models requiring remote code cannot operate normally in disconnected environments because the library attempts network access even when offline mode is configured.\"},\"tunes\":{}},{\"id\":\"p-remote-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The practical lesson is to test a model's entire loading path offline before approving it for an isolated deployment. “I downloaded the weights” is not proof that the model is self-contained.\"},\"tunes\":{}},{\"id\":\"h-artifacts\",\"type\":\"header\",\"data\":{\"text\":\"Containers, packages and drivers become local supply-chain artifacts\",\"level\":2},\"tunes\":{}},{\"id\":\"p-artifacts-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Connected environments routinely pull container images, Python packages, OS updates and GPU components from public registries. An air-gapped environment cannot assume any of those services.\"},\"tunes\":{}},{\"id\":\"p-artifacts-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Red Hat's disconnected AI deployment model uses internal mirror registries for container images and operator catalogs. Models can be mirrored as OCI artifacts or transferred to persistent storage.\"},\"tunes\":{}},{\"id\":\"p-artifacts-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"For broader stacks, the same pattern often applies to language packages, Linux repositories, JavaScript packages and internal binaries: approved artifacts enter once through the transfer process and are then served from trusted internal repositories.\"},\"tunes\":{}},{\"id\":\"h-bom\",\"type\":\"header\",\"data\":{\"text\":\"Know the complete dependency bill\",\"level\":2},\"tunes\":{}},{\"id\":\"dependency-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Dependency class\",\"Examples\"],[\"Model artifacts\",\"Weights, tokenizer, config, adapters, quantization metadata\"],[\"Inference runtime\",\"vLLM, llama.cpp, Ollama, NIM or other serving runtime\"],[\"GPU\u002Fruntime stack\",\"Drivers, CUDA\u002FROCm libraries, container runtime\"],[\"Application packages\",\"Python wheels, npm packages, system libraries\"],[\"Containers\",\"Application, inference, DB, vector DB, monitoring images\"],[\"RAG models\",\"Embedding model, reranker, OCR\u002Fvision models\"],[\"Data\",\"Knowledge corpus, metadata, schemas, evaluation datasets\"],[\"Security material\",\"Certificates, CA bundles, policy\u002Fconfiguration, malware signatures where applicable\"],[\"Operational artifacts\",\"Dashboards, alert rules, backup tools, runbooks\"],[\"Licensing\",\"Offline-compatible licenses\u002Fentitlements where required\"]]},\"tunes\":{}},{\"id\":\"h-mirror\",\"type\":\"header\",\"data\":{\"text\":\"Internal mirrors are infrastructure, not a convenience\",\"level\":2},\"tunes\":{}},{\"id\":\"p-mirror-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A disconnected deployment becomes maintainable when the isolated domain has known internal sources for approved artifacts.\"},\"tunes\":{}},{\"id\":\"p-mirror-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Red Hat's documented approach uses a mirror registry available to the disconnected cluster so workloads do not need public registries.\"},\"tunes\":{}},{\"id\":\"p-mirror-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The same architectural idea can be applied to model stores and package repositories. The objective is to make artifact origin, version and approval explicit rather than copy random files manually to each server.\"},\"tunes\":{}},{\"id\":\"h-rag\",\"type\":\"header\",\"data\":{\"text\":\"RAG can work fully air-gapped\",\"level\":2},\"tunes\":{}},{\"id\":\"p-rag-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"RAG does not require the public internet. It requires a retrievable corpus, an ingestion\u002Findexing pipeline and a model that can use the retrieved context.\"},\"tunes\":{}},{\"id\":\"p-rag-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Inside an air-gapped environment, the document store, parser\u002FOCR, embedding model, vector or lexical index, reranker and generation model can all run locally.\"},\"tunes\":{}},{\"id\":\"p-rag-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"What changes is source acquisition. Live web search and cloud document connectors are unavailable unless equivalent data is imported through the controlled boundary.\"},\"tunes\":{}},{\"id\":\"p-rag-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"The corpus therefore becomes a governed artifact. Every import should preserve source identity, date\u002Fversion and provenance so users know what knowledge the isolated system actually contains.\"},\"tunes\":{}},{\"id\":\"ref-rag\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works\",\"title\":\"What Is RAG? The Simplest Explanation of How It Works\",\"excerpt\":\"RAG itself is independent of cloud hosting. In an air-gapped architecture, retrieval and generation simply have to be supplied by local\u002Finternal components.\",\"ctaLabel\":\"Read the RAG foundation\"},\"tunes\":{}},{\"id\":\"h-agents\",\"type\":\"header\",\"data\":{\"text\":\"Agents can run air-gapped — but only with reachable tools\",\"level\":2},\"tunes\":{}},{\"id\":\"p-agents-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An agent loop can run entirely inside an isolated enclave if the model\u002Fruntime and required tools are local or reachable on the internal network.\"},\"tunes\":{}},{\"id\":\"p-agents-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A tool that depends on GitHub, public web search, cloud email or an external SaaS API will fail unless the architecture provides an approved internal equivalent or controlled asynchronous exchange process.\"},\"tunes\":{}},{\"id\":\"p-agents-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"This is why air-gapped agent design should begin with a capability inventory: every tool endpoint must be classified as internal, imported, unavailable or deliberately excluded.\"},\"tunes\":{}},{\"id\":\"h-mcp\",\"type\":\"header\",\"data\":{\"text\":\"MCP does not bypass the air gap\",\"level\":2},\"tunes\":{}},{\"id\":\"p-mcp-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"MCP can expose local tools and resources inside an isolated AI environment, but the protocol does not create connectivity through the security boundary.\"},\"tunes\":{}},{\"id\":\"p-mcp-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A local MCP server that reads internal documents can work perfectly offline. A remote MCP server on the public internet cannot be reached from a strict air-gapped enclave.\"},\"tunes\":{}},{\"id\":\"p-mcp-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The same principle applies to any connector protocol: interoperability is separate from network authority.\"},\"tunes\":{}},{\"id\":\"h-identity\",\"type\":\"header\",\"data\":{\"text\":\"Identity and authentication must also work offline\",\"level\":2},\"tunes\":{}},{\"id\":\"p-id-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An AI application can be locally hosted while still depending on a cloud identity provider. That hidden dependency breaks truly disconnected operation.\"},\"tunes\":{}},{\"id\":\"p-id-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped designs therefore need an identity architecture that functions inside the enclave: local directory, internal identity provider, internal PKI, local service credentials or another approved mechanism.\"},\"tunes\":{}},{\"id\":\"p-id-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Authorization remains necessary even though the internet is absent. Air gaps do not replace RBAC, tenant isolation or least privilege.\"},\"tunes\":{}},{\"id\":\"h-time\",\"type\":\"header\",\"data\":{\"text\":\"Time, certificates and trust stores become local dependencies\",\"level\":2},\"tunes\":{}},{\"id\":\"p-time-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Many authentication and logging systems depend on reliable time. Certificates expire. Trust stores change. Signed artifacts need validation.\"},\"tunes\":{}},{\"id\":\"p-time-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A disconnected enclave should therefore have internal time synchronization and a certificate\u002Ftrust lifecycle that does not depend on reaching public services during ordinary operation.\"},\"tunes\":{}},{\"id\":\"p-time-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"These are ordinary infrastructure concerns that become visible only when an architecture is tested without internet access.\"},\"tunes\":{}},{\"id\":\"h-telemetry\",\"type\":\"header\",\"data\":{\"text\":\"Telemetry and crash reporting need explicit policy\",\"level\":2},\"tunes\":{}},{\"id\":\"p-tel-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Many modern libraries attempt analytics, update checks or error reporting by default.\"},\"tunes\":{}},{\"id\":\"p-tel-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"In an isolated environment those calls should either be disabled or redirected to internal observability. Repeated failed telemetry attempts can create delays, noisy logs and unexpected startup behavior.\"},\"tunes\":{}},{\"id\":\"p-tel-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"An air-gapped deployment should know which components attempt egress even if the firewall would block them.\"},\"tunes\":{}},{\"id\":\"h-updates\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapped systems still need patches\",\"level\":2},\"tunes\":{}},{\"id\":\"p-update-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Network isolation does not stop software from developing vulnerabilities. It only changes how patches reach the system.\"},\"tunes\":{}},{\"id\":\"p-update-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST frames patch management as preventive maintenance: organizations still need to identify, acquire, prioritize, install and verify patches and updates.\"},\"tunes\":{}},{\"id\":\"p-update-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped operations therefore need a repeatable import cadence for OS packages, container images, drivers, AI runtimes and security updates. The trade-off is between isolation stability and vulnerability exposure from stale software.\"},\"tunes\":{}},{\"id\":\"h-patch-flow\",\"type\":\"header\",\"data\":{\"text\":\"A controlled update path\",\"level\":2},\"tunes\":{}},{\"id\":\"patch-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Example update lifecycle for an isolated AI environment\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Identify required update\",\"description\":\"Security advisory, model\u002Fruntime improvement or operational need triggers change.\"},{\"label\":\"2. Acquire in connected staging\",\"description\":\"Download exact versions plus signatures\u002Fchecksums and metadata.\"},{\"label\":\"3. Validate supply-chain evidence\",\"description\":\"Verify source, integrity, compatibility and policy requirements.\"},{\"label\":\"4. Test in representative offline staging\",\"description\":\"Confirm the update works without unexpected network dependencies.\"},{\"label\":\"5. Approve transfer\",\"description\":\"Apply the organization's change and security process.\"},{\"label\":\"6. Import into enclave repository\",\"description\":\"Publish the artifact to the internal trusted source.\"},{\"label\":\"7. Deploy gradually\",\"description\":\"Apply to test\u002Fcanary nodes before wider rollout where architecture permits.\"},{\"label\":\"8. Verify and record\",\"description\":\"Confirm version, health, behavior and rollback state.\"}]},\"tunes\":{}},{\"id\":\"h-transfer\",\"type\":\"header\",\"data\":{\"text\":\"The transfer boundary is the most sensitive operational interface\",\"level\":2},\"tunes\":{}},{\"id\":\"p-transfer-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"If external information must enter an air-gapped system, the import channel becomes a major security control point.\"},\"tunes\":{}},{\"id\":\"p-transfer-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The NSA Cybersecurity Technical Cyber Threat Framework explicitly recognizes replication through removable media as a path adversaries can use to cross into disconnected or air-gapped networks.\"},\"tunes\":{}},{\"id\":\"p-transfer-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"That is why controlled media handling, inspection, provenance, encryption where required, malware scanning and role separation can matter as much as the AI stack itself.\"},\"tunes\":{}},{\"id\":\"h-media\",\"type\":\"header\",\"data\":{\"text\":\"Removable media is not a neutral pipe\",\"level\":2},\"tunes\":{}},{\"id\":\"p-media-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"USB drives and other portable media can carry both legitimate model\u002Fdata artifacts and malicious content.\"},\"tunes\":{}},{\"id\":\"p-media-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST's media-sanitization guidance treats storage media as a confidentiality lifecycle object that may require clearing, purging or destruction according to sensitivity and reuse needs.\"},\"tunes\":{}},{\"id\":\"p-media-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The exact transfer procedure is organization-specific, but the architectural principle is stable: cross-boundary media should be governed as a security asset, not treated as an informal convenience.\"},\"tunes\":{}},{\"id\":\"h-supply\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapping increases supply-chain importance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-supply-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An isolated system receives fewer live external inputs, but every imported binary, model, container and package becomes more consequential because the enclave may trust it for a long time.\"},\"tunes\":{}},{\"id\":\"p-supply-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST software-supply-chain guidance emphasizes provenance, supplier risk, vulnerability management, software verification and SBOM-oriented practices. These concerns become directly relevant to offline AI artifact import.\"},\"tunes\":{}},{\"id\":\"p-supply-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model supply chain deserves the same attention as application supply chain: model origin, license, hash, format, required code, tokenizer, adapters and evaluation status should be known before import.\"},\"tunes\":{}},{\"id\":\"h-readiness\",\"type\":\"header\",\"data\":{\"text\":\"Air-gap readiness should be tested, not assumed\",\"level\":2},\"tunes\":{}},{\"id\":\"readiness-note\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Proposed validation pattern\",\"body\":\"The following air-gap-readiness test is an engineering synthesis, not a NIST or vendor certification method. It is designed to expose hidden external dependencies before deployment.\"},\"tunes\":{}},{\"id\":\"readiness-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Test\",\"What it proves\"],[\"Cold start with all outbound network blocked\",\"Runtime does not require public services during startup\"],[\"Load every approved model from local storage\",\"Weights\u002Ftokenizers\u002Fconfigs are complete\"],[\"Rebuild\u002Fredeploy from internal registries only\",\"Container\u002Fpackage mirrors are sufficient\"],[\"Authenticate users while external IdP is unreachable\",\"Identity works inside the enclave\"],[\"Run RAG ingestion and query offline\",\"Embedding\u002Findexing\u002Fretrieval stack is local\"],[\"Run representative agent tools\",\"Tools do not depend on external APIs\"],[\"Restart after cache deletion\",\"Offline operation is not accidentally relying on previously cached downloads\"],[\"Advance simulated certificate\u002Fupdate lifecycle\",\"Trust and maintenance dependencies are understood\"],[\"Import a new model through staging path\",\"Transfer\u002Fchange procedure is operational\"],[\"Restore from backup\",\"Recovery does not require unavailable cloud storage\"]]},\"tunes\":{}},{\"id\":\"h-cache\",\"type\":\"header\",\"data\":{\"text\":\"Cached once is not the same as air-gap ready\",\"level\":2},\"tunes\":{}},{\"id\":\"p-cache-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A system may appear offline because the model and packages are already cached from earlier internet access.\"},\"tunes\":{}},{\"id\":\"p-cache-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Deleting caches or deploying to a clean node can reveal missing tokenizer files, Python packages, model manifests or remote-code dependencies.\"},\"tunes\":{}},{\"id\":\"p-cache-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gap readiness should therefore be validated from clean internal artifacts, not only from a developer workstation that was previously connected.\"},\"tunes\":{}},{\"id\":\"h-threats\",\"type\":\"header\",\"data\":{\"text\":\"What threats remain inside an air gap?\",\"level\":2},\"tunes\":{}},{\"id\":\"threat-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Threat\",\"Why the air gap does not remove it\"],[\"Compromised imported artifact\",\"Malware\u002Fmodel\u002Fpackage can enter through the authorized transfer path\"],[\"Malicious removable media\",\"Physical transfer can carry executable payloads\"],[\"Insider misuse\",\"Authorized users already exist inside the enclave\"],[\"Prompt injection in imported documents\",\"Untrusted content can influence RAG\u002Fagents without internet\"],[\"Overprivileged agent tools\",\"Local tools can still damage local systems\"],[\"Cross-tenant data leakage\",\"Internal authorization bugs remain possible\"],[\"Vulnerable internal software\",\"Lack of external connection does not remove exploitable bugs\"],[\"Lateral movement\",\"A compromised node can attack other internally connected nodes\"],[\"Stale dependencies\",\"Slow update cadence can leave known vulnerabilities unpatched\"],[\"Physical theft\u002Ftampering\",\"Hardware and media security remain critical\"],[\"Bad model behavior\",\"Hallucination, bias and task failure are independent of networking\"],[\"Supply-chain poisoning\",\"Trusted import sources can still be compromised\"]]},\"tunes\":{}},{\"id\":\"h-benefits\",\"type\":\"header\",\"data\":{\"text\":\"What an air gap actually improves\",\"level\":2},\"tunes\":{}},{\"id\":\"p-benefit-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A genuine air gap can materially reduce attack paths that depend on direct remote connectivity: external command-and-control, cloud credential misuse, internet-facing service exploitation and accidental data exfiltration through ordinary outbound APIs.\"},\"tunes\":{}},{\"id\":\"p-benefit-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"It also makes data residency simple in one narrow sense: inference data cannot be sent to an external cloud service if no path exists.\"},\"tunes\":{}},{\"id\":\"p-benefit-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Those benefits are strongest when the transfer boundary and internal access controls are equally disciplined. A poorly managed USB process can undermine the intended isolation.\"},\"tunes\":{}},{\"id\":\"h-costs\",\"type\":\"header\",\"data\":{\"text\":\"What an air gap makes harder\",\"level\":2},\"tunes\":{}},{\"id\":\"cost-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Area\",\"Operational consequence\"],[\"Model updates\",\"Manual\u002Fstaged transfer instead of direct model-hub pull\"],[\"Security patches\",\"Delayed and governed import workflow\"],[\"Package installation\",\"Internal mirrors or prebuilt artifacts required\"],[\"Cloud AI APIs\",\"Unavailable\"],[\"Web search\u002Fconnectors\",\"Unavailable unless data is imported separately\"],[\"Authentication\",\"Needs internal\u002Foffline-capable identity services\"],[\"Monitoring\",\"Needs internal observability and controlled export\"],[\"Licensing\",\"Products requiring online activation may be unsuitable\"],[\"Troubleshooting\",\"No easy live access to vendor resources from production enclave\"],[\"Capacity\",\"All inference compute must exist locally\"],[\"Disaster recovery\",\"Cloud backups may be unavailable or policy-restricted\"],[\"Knowledge freshness\",\"External information arrives only as fast as the import process\"]]},\"tunes\":{}},{\"id\":\"h-private\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapped AI vs private AI\",\"level\":2},\"tunes\":{}},{\"id\":\"p-private-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Private AI is primarily about controlling sensitive data and AI processing. A private AI platform may be on-premises and still access approved cloud models or external services.\"},\"tunes\":{}},{\"id\":\"p-private-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped AI is stricter on connectivity. A system can be private without being air-gapped, and an air-gapped system can still have poor privacy if every internal user has unrestricted access.\"},\"tunes\":{}},{\"id\":\"p-private-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The security objective should determine the architecture: confidentiality, sovereignty, resilience and isolation are related but distinct requirements.\"},\"tunes\":{}},{\"id\":\"h-sovereign\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapped AI vs sovereign AI\",\"level\":2},\"tunes\":{}},{\"id\":\"p-sovereign-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Sovereign AI concerns control over the broader dependency chain: data, models, infrastructure, operators, jurisdiction and strategic dependencies.\"},\"tunes\":{}},{\"id\":\"p-sovereign-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"An air gap can support sovereignty by reducing external runtime dependency, but it does not guarantee sovereign control. The enclave may still depend on foreign hardware, proprietary model licenses or external update suppliers.\"},\"tunes\":{}},{\"id\":\"p-sovereign-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The next canonical article separates those control dimensions explicitly.\"},\"tunes\":{}},{\"id\":\"h-implementation\",\"type\":\"header\",\"data\":{\"text\":\"Original implementation evidence: what the Aaasaasa AI Client proves — and what it does not\",\"level\":2},\"tunes\":{}},{\"id\":\"impl-note\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Implementation boundary\",\"body\":\"Aaasaasa AI Client is useful evidence for \u003Cstrong>local inference architecture\u003C\u002Fstrong>, provider abstraction and separation of runtime\u002Fmodel location. It is \u003Cstrong>not evidence of a deployed air-gapped environment\u003C\u002Fstrong>. The repository also supports cloud and remote paths, and no verified project evidence establishes a physically isolated security domain.\"},\"tunes\":{}},{\"id\":\"p-impl-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The AI Hub separates agent\u002Fclient, provider, model and connection location. It supports local Ollama inference and local-provider Codex operation as distinct choices rather than assuming that every AI request goes to a cloud model.\"},\"tunes\":{}},{\"id\":\"p-impl-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The repository explicitly notes that a local runtime can still use a cloud model, while Direct Ollama chat is local inference. This distinction is directly relevant to air-gap architecture: local execution does not prove that the model or surrounding dependencies are disconnected.\"},\"tunes\":{}},{\"id\":\"p-impl-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Provider abstraction, local model discovery and local inference are therefore building blocks for an air-gap-capable product architecture, but the network boundary, offline dependency mirror, controlled transfer process and offline identity\u002Foperations must still be engineered separately.\"},\"tunes\":{}},{\"id\":\"impl-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Verified project capability\",\"Air-gap relevance\"],[\"Local Ollama inference\",\"Supports local model execution\"],[\"Local provider\u002Fruntime paths\",\"Reduces dependency on cloud inference\"],[\"Provider\u002Fmodel\u002Fruntime separation\",\"Makes cloud dependencies explicit rather than hidden\"],[\"Central permissions\",\"Supports local tool\u002Fdata access control\"],[\"Cloud\u002Fremote provider support also exists\",\"Proves the product itself is hybrid-capable, not inherently air-gapped\"],[\"No verified isolated deployment boundary\",\"Prevents overclaiming air-gap maturity\"]]},\"tunes\":{}},{\"id\":\"h-when\",\"type\":\"header\",\"data\":{\"text\":\"When is air-gapped AI justified?\",\"level\":2},\"tunes\":{}},{\"id\":\"when-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Air gap may be justified when\",\"A connected private architecture may be better when\"],[\"Security policy explicitly requires physically separated domains\",\"Main requirement is only that prompts\u002Fdata are not used by public consumer services\"],[\"Classified or extremely sensitive data cannot cross external networks\",\"Approved enterprise cloud\u002Fprivate endpoints satisfy data controls\"],[\"Operational environment has no reliable external connectivity\",\"Internet is available and operational agility matters\"],[\"Mission continuity must not depend on cloud\u002Fprovider availability\",\"Managed model quality and rapid upgrades are more valuable\"],[\"Regulated\u002Fcritical environment mandates controlled transfer\",\"Standard security controls can meet the actual threat model\"],[\"External SaaS\u002FAPI access is prohibited\",\"Business workflow relies heavily on external connectors\"]]},\"tunes\":{}},{\"id\":\"p-when-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapping should be a requirement derived from a threat model or policy, not a prestige feature. It has real security value when the eliminated connectivity path is itself unacceptable.\"},\"tunes\":{}},{\"id\":\"p-when-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"For many enterprise use cases, a tightly controlled private network with egress restrictions, local inference and approved update channels may provide a better balance of security and maintainability than a strict physical air gap.\"},\"tunes\":{}},{\"id\":\"h-design\",\"type\":\"header\",\"data\":{\"text\":\"A practical air-gapped AI design sequence\",\"level\":2},\"tunes\":{}},{\"id\":\"design-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Design from the boundary inward\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Define what the air gap separates\",\"description\":\"Name the security domains and whether the requirement is strict physical separation or simply no internet.\"},{\"label\":\"2. Inventory every external dependency\",\"description\":\"Models, packages, registries, identity, telemetry, licensing, storage, APIs, DNS\u002Ftime and support services.\"},{\"label\":\"3. Select offline-capable models and runtimes\",\"description\":\"Verify model assets and runtime code can load without remote calls.\"},{\"label\":\"4. Build internal artifact repositories\",\"description\":\"Create trusted sources for containers, packages, models and updates.\"},{\"label\":\"5. Design controlled transfer\",\"description\":\"Define staging, verification, media\u002Fgateway handling, approval and provenance.\"},{\"label\":\"6. Build internal identity and authorization\",\"description\":\"Ensure users, services and tools can authenticate without cloud dependencies.\"},{\"label\":\"7. Keep RAG and tools local\",\"description\":\"Deploy knowledge, embeddings, indexes and required service APIs inside the enclave.\"},{\"label\":\"8. Build internal observability\",\"description\":\"Operate logs, metrics, traces and security monitoring locally.\"},{\"label\":\"9. Define patch\u002Fmodel update cadence\",\"description\":\"Balance vulnerability response with the controlled import process.\"},{\"label\":\"10. Test from a clean disconnected state\",\"description\":\"Cold-start and operate without inherited caches or hidden internet access.\"},{\"label\":\"11. Test compromise paths\",\"description\":\"Exercise removable-media, supply-chain, prompt-injection, insider and lateral-movement scenarios.\"},{\"label\":\"12. Document exceptions and exports\",\"description\":\"Every permitted cross-boundary path should have a named purpose, owner and control set.\"}]},\"tunes\":{}},{\"id\":\"h-checklist\",\"type\":\"header\",\"data\":{\"text\":\"Air-gapped AI architecture checklist\",\"level\":2},\"tunes\":{}},{\"id\":\"checklist-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Question\",\"Expected evidence\"],[\"What exactly is isolated from what?\",\"Documented security-domain boundary\"],[\"Is the boundary physically disconnected?\",\"Network\u002Fphysical architecture evidence if strict air gap is claimed\"],[\"How does data cross the boundary?\",\"Authorized non-automated\u002Fmanual or explicitly documented disconnected workflow\"],[\"Can every model cold-start offline?\",\"Offline loading test\"],[\"Are tokenizer\u002Fconfig\u002Fruntime assets complete?\",\"Verified internal model bundle\"],[\"Where do containers\u002Fpackages come from?\",\"Internal trusted mirror\u002Frepository\"],[\"Can identity work without cloud services?\",\"Internal IdP\u002FPKI\u002Fservice credential path\"],[\"Can RAG ingest\u002Fquery offline?\",\"Local ingestion, embeddings, index and retrieval\"],[\"Which agent tools remain available?\",\"Internal capability inventory\"],[\"How are patches imported?\",\"Controlled maintenance process\"],[\"How are artifacts verified?\",\"Integrity\u002Fprovenance\u002Fmalware\u002Fsupply-chain controls\"],[\"How is removable media governed?\",\"Media handling and sanitization policy\"],[\"Can the system run after caches are cleared?\",\"Clean-environment offline test\"],[\"Where are logs and traces stored?\",\"Internal observability platform\"],[\"How are exports approved?\",\"Controlled egress process\"],[\"What proves this is air-gapped rather than merely local?\",\"Boundary and transfer evidence, not model location\"]]},\"tunes\":{}},{\"id\":\"h-failures\",\"type\":\"header\",\"data\":{\"text\":\"Common air-gapped AI failure modes\",\"level\":2},\"tunes\":{}},{\"id\":\"failure-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Failure mode\",\"What actually failed\"],[\"Local model still downloads tokenizer\u002Fconfig at startup\",\"Model bundle was incomplete\"],[\"Container references public registry\",\"Deployment was not self-contained\"],[\"Cloud identity required for login\",\"Application was local but identity was not\"],[\"License server required externally\",\"Vendor dependency contradicted offline operation\"],[\"Embedding model missing\",\"Chat works but RAG ingestion fails\"],[\"Agent tool calls public SaaS\",\"Agent architecture was not air-gap compatible\"],[\"Only GPU node is isolated\",\"Database, UI or monitoring still depends on external services\"],[\"USB imports are informal\",\"Transfer boundary becomes uncontrolled attack path\"],[\"No patch process\",\"Isolation creates growing vulnerability debt\"],[\"Cached developer machine used as proof\",\"Fresh deployment fails without internet\"],[\"Air gap replaces authorization thinking\",\"Internal users\u002Fservices become overprivileged\"],[\"Air-gapped label used for firewall-only egress block\",\"Security documentation overstates the actual boundary\"]]},\"tunes\":{}},{\"id\":\"h-misconceptions\",\"type\":\"header\",\"data\":{\"text\":\"Common misconceptions\",\"level\":2},\"tunes\":{}},{\"id\":\"misconceptions-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Misconception\",\"Correction\"],[\"“Local AI is air-gapped AI.”\",\"Local describes where inference runs; air gap describes the security\u002Fnetwork boundary.\"],[\"“Air-gapped means one standalone PC.”\",\"An isolated enclave can contain an entire internal network or cluster.\"],[\"“No internet equals strict air gap.”\",\"Under NIST's definition, the separated systems also lack physical connection and cross-boundary transfer is non-automated.\"],[\"“Air gaps eliminate cyber risk.”\",\"Supply-chain, removable-media, insider, internal-network and application risks remain.\"],[\"“RAG needs the cloud.”\",\"RAG can run entirely with local models, indexes and data.\"],[\"“Agents cannot work offline.”\",\"Agents can use internal\u002Flocal tools; they simply cannot reach unavailable external services.\"],[\"“Once installed, the system needs no updates.”\",\"Patches, drivers, models and dependencies still require lifecycle management.\"],[\"“A downloaded model is self-contained.”\",\"Tokenizers, remote code, libraries or model assets may still trigger network dependencies.\"],[\"“Private AI and air-gapped AI are identical.”\",\"Private AI is a data\u002Fcontrol property; air gap is a connectivity property.\"],[\"“Air gap guarantees sovereignty.”\",\"External hardware, licenses, models and supply chain can remain dependencies.\"]]},\"tunes\":{}},{\"id\":\"h-limitations\",\"type\":\"header\",\"data\":{\"text\":\"Limitations\",\"level\":2},\"tunes\":{}},{\"id\":\"p-limit-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Strict air gaps make external knowledge freshness slower because every new source must pass through a transfer process.\"},\"tunes\":{}},{\"id\":\"p-limit-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"They can constrain model choice when licenses, remote-code requirements, hardware needs or provider-only APIs cannot be satisfied offline.\"},\"tunes\":{}},{\"id\":\"p-limit-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"They increase operational cost because infrastructure normally consumed as cloud services must be owned and maintained internally.\"},\"tunes\":{}},{\"id\":\"p-limit-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"They can also create patch latency: stronger change control may keep systems stable while delaying urgent vulnerability remediation.\"},\"tunes\":{}},{\"id\":\"p-limit-5\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped AI should therefore be evaluated as one security architecture among several, not assumed to be universally superior.\"},\"tunes\":{}},{\"id\":\"h-change\",\"type\":\"header\",\"data\":{\"text\":\"What would change this answer?\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Vendor support for disconnected operation changes quickly. New model formats, signed OCI artifacts, offline license mechanisms and integrated model registries can reduce operational friction.\"},\"tunes\":{}},{\"id\":\"p-change-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The distinction between strict air gap and disconnected deployment will remain important even if vendors continue using the terms loosely.\"},\"tunes\":{}},{\"id\":\"p-change-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The stable principle is that genuine air-gap claims depend on the system boundary and transfer mechanism, not on whether the LLM happens to run locally.\"},\"tunes\":{}},{\"id\":\"h-related\",\"type\":\"header\",\"data\":{\"text\":\"Related canonical knowledge\",\"level\":2},\"tunes\":{}},{\"id\":\"p-related-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-Gapped AI is a deployment\u002Fsecurity architecture node. Private AI, Sovereign AI and provider abstraction answer different questions about confidentiality, control and dependency.\"},\"tunes\":{}},{\"id\":\"p-related-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"MLOps\u002FLLMOps becomes more demanding inside a disconnected environment because model, package and update lifecycles must operate through internal repositories and controlled transfer.\"},\"tunes\":{}},{\"id\":\"p-related-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"RAG and Agentic AI remain valid patterns inside the enclave as long as their data and tools are internally available.\"},\"tunes\":{}},{\"id\":\"ref-memory\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\",\"title\":\"AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context\",\"excerpt\":\"Air-gapped AI still needs correct internal boundaries between durable memory, authoritative state, retrieval and model context.\",\"ctaLabel\":\"Read the memory architecture article\"},\"tunes\":{}},{\"id\":\"h-faq\",\"type\":\"header\",\"data\":{\"text\":\"Frequently asked questions\",\"level\":2},\"tunes\":{}},{\"id\":\"faq\",\"type\":\"faq\",\"data\":{\"title\":\"Air-gapped AI FAQ\",\"items\":[{\"id\":\"faq1\",\"question\":\"What is air-gapped AI?\",\"answer\":\"Air-gapped AI is AI deployed inside a security domain physically disconnected from the external systems it is separated from, with cross-boundary transfer performed through controlled non-automated procedures under the strict NIST definition.\"},{\"id\":\"faq2\",\"question\":\"Does air-gapped AI need internet access?\",\"answer\":\"No for normal inference and operation. Required models, packages, data and services must be available inside the isolated environment.\"},{\"id\":\"faq3\",\"question\":\"Is a local LLM automatically air-gapped?\",\"answer\":\"No. A local model can run on a machine that still has internet access or uses cloud identity, tools or storage. Air gap describes the complete system boundary.\"},{\"id\":\"faq4\",\"question\":\"Can RAG work in an air-gapped network?\",\"answer\":\"Yes. Documents, embedding models, vector or lexical indexes, rerankers and generation models can all run locally. External knowledge must be imported through the controlled boundary.\"},{\"id\":\"faq5\",\"question\":\"Can AI agents work air-gapped?\",\"answer\":\"Yes, if their tools and required systems are available inside the isolated network. Public SaaS and cloud APIs are unavailable without a permitted cross-boundary mechanism.\"},{\"id\":\"faq6\",\"question\":\"How are models updated in an air-gapped environment?\",\"answer\":\"Models are typically acquired and validated in a connected staging environment, transferred through an approved process and published to an internal model\u002Fartifact repository.\"},{\"id\":\"faq7\",\"question\":\"Is on-premises AI the same as air-gapped AI?\",\"answer\":\"No. On-premises describes infrastructure location. On-prem systems can remain internet-connected.\"},{\"id\":\"faq8\",\"question\":\"Is private AI the same as air-gapped AI?\",\"answer\":\"No. Private AI is about data\u002Fcontrol requirements and can still use connected infrastructure. Air gap specifically describes network\u002Fdomain separation.\"},{\"id\":\"faq9\",\"question\":\"Does an air gap make AI secure?\",\"answer\":\"It removes or reduces some remote connectivity risks but does not remove supply-chain, removable-media, insider, internal authorization, physical or model-behavior risks.\"},{\"id\":\"faq10\",\"question\":\"What is the best test for air-gap readiness?\",\"answer\":\"Deploy or cold-start the full stack in a clean environment with all external connectivity unavailable and verify that models, identity, RAG, tools, monitoring, updates and recovery depend only on approved internal artifacts and services.\"}]},\"tunes\":{}},{\"id\":\"h-glossary\",\"type\":\"header\",\"data\":{\"text\":\"Glossary\",\"level\":2},\"tunes\":{}},{\"id\":\"glossary\",\"type\":\"glossary\",\"data\":{\"title\":\"Key air-gapped AI terms\",\"entries\":[{\"term\":\"Air gap\",\"definition\":\"Security-domain interface where systems are not physically connected and any cross-boundary logical transfer is non-automated\u002Fmanual under the NIST glossary definition.\",\"anchor\":\"air-gap\"},{\"term\":\"Air-gapped AI\",\"definition\":\"AI system deployed inside an air-gapped security domain with locally available inference and operational dependencies.\",\"anchor\":\"air-gapped-ai\"},{\"term\":\"Disconnected environment\",\"definition\":\"Deployment environment without direct outside-internet access; implementations may use controlled mirror or bastion workflows.\",\"anchor\":\"disconnected-environment\"},{\"term\":\"Offline-capable AI\",\"definition\":\"AI application able to operate for some or all functions without internet connectivity, without necessarily being permanently isolated.\",\"anchor\":\"offline-capable-ai\"},{\"term\":\"Local AI\",\"definition\":\"AI inference or runtime executing on local hardware rather than a remote model endpoint; does not imply network isolation.\",\"anchor\":\"local-ai\"},{\"term\":\"Mirror registry\",\"definition\":\"Internal repository containing approved copies of container images or other artifacts needed by a disconnected deployment.\",\"anchor\":\"mirror-registry\"},{\"term\":\"Staging environment\",\"definition\":\"Connected or controlled zone where artifacts are acquired, verified and prepared before transfer into an isolated domain.\",\"anchor\":\"staging-environment\"},{\"term\":\"Controlled transfer\",\"definition\":\"Governed movement of data or software across the isolation boundary using approved media\u002Fprocesses and verification.\",\"anchor\":\"controlled-transfer\"},{\"term\":\"Artifact provenance\",\"definition\":\"Information showing where a model, package, container or other imported artifact originated and how it was produced or verified.\",\"anchor\":\"artifact-provenance\"},{\"term\":\"Removable media\",\"definition\":\"Portable storage used to transfer data between systems; a potential security path across disconnected domains.\",\"anchor\":\"removable-media\"},{\"term\":\"Internal model store\",\"definition\":\"Repository inside the isolated environment from which approved model artifacts are served or deployed.\",\"anchor\":\"internal-model-store\"},{\"term\":\"Air-gap readiness\",\"definition\":\"Demonstrated ability of the complete AI stack to install, start, operate, update and recover without unapproved external connectivity.\",\"anchor\":\"air-gap-readiness\"}]},\"tunes\":{}},{\"id\":\"h-conclusion\",\"type\":\"header\",\"data\":{\"text\":\"Conclusion\",\"level\":2},\"tunes\":{}},{\"id\":\"p-conclusion-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Air-gapped AI is not a special kind of model. It is an AI architecture operating inside a deliberately isolated security domain.\"},\"tunes\":{}},{\"id\":\"p-conclusion-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The model can be the easy part. Production readiness depends on whether every surrounding dependency — model assets, packages, registries, identity, RAG, tools, monitoring, updates and recovery — can function without an automated external path.\"},\"tunes\":{}},{\"id\":\"p-conclusion-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The shortest reliable rule is: local inference proves where the model runs; air-gap evidence proves how the complete system is separated and how every permitted transfer crosses that boundary.\"},\"tunes\":{}},{\"id\":\"h-sources\",\"type\":\"header\",\"data\":{\"text\":\"Primary sources and current implementation references\",\"level\":2},\"tunes\":{}},{\"id\":\"p-sources-note\",\"type\":\"paragraph\",\"data\":{\"text\":\"The sources below establish the security definition, current disconnected AI deployment patterns and lifecycle risks. Vendor use of “air-gapped” is intentionally distinguished from the stricter NIST definition.\"},\"tunes\":{}},{\"id\":\"src-nist-airgap\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fair_gap\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST CSRC — Air gap\",\"description\":\"NIST glossary definition: physically disconnected systems with non-automated, manually controlled logical transfer across the boundary.\"}},\"tunes\":{}},{\"id\":\"src-nvidia-airgap\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdocs.nvidia.com\u002Fnim\u002Flarge-language-models\u002Flatest\u002Fdeploy-air-gap.html\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NVIDIA NIM — Air-Gap Deployment\",\"description\":\"Current operational guidance for staging model assets on a connected system and running NIM from local storage without internet, public registries or cloud API keys.\"}},\"tunes\":{}},{\"id\":\"src-redhat-disconnected\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Findex\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"Red Hat AI Inference — Disconnected deployment\",\"description\":\"Current Red Hat guidance for serving LLMs in disconnected environments with mirrored artifacts and internal infrastructure.\"}},\"tunes\":{}},{\"id\":\"src-redhat-models\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdocs.redhat.com\u002Fen\u002Fdocumentation\u002Fred_hat_ai_inference\u002F3.5\u002Fhtml\u002Fdeploy_the_standalone_red_hat_ai_inference_container_in_a_disconnected_environment\u002Fstoring-models-in-disconnected-environments_disconnected-deploy\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"Red Hat AI Inference — Storing models in disconnected environments\",\"description\":\"Current guidance covering OCI model images, persistent model storage and limitations of models requiring remote code.\"}},\"tunes\":{}},{\"id\":\"src-nsa-framework\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nsa.gov\u002Fportals\u002F75\u002Fdocuments\u002Fwhat-we-do\u002Fcybersecurity\u002Fprofessional-resources\u002Fctr-nsa-css-technical-cyber-threat-framework.pdf\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NSA — Technical Cyber Threat Framework\",\"description\":\"Threat framework explicitly identifying removable-media replication as a path into disconnected or air-gapped networks.\"}},\"tunes\":{}},{\"id\":\"src-nist-media\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fguidelines-media-sanitization\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization\",\"description\":\"Guidance for managing and sanitizing storage media according to information confidentiality requirements.\"}},\"tunes\":{}},{\"id\":\"src-nist-patch\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F40\u002Fr4\u002Ffinal\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST SP 800-40 Rev. 4 — Enterprise Patch Management Planning\",\"description\":\"Guidance framing patching and updates as preventive maintenance across enterprise systems.\"}},\"tunes\":{}},{\"id\":\"src-nist-supply\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fexecutive-order-14028-improving-nations-cybersecurity\u002Fsoftware-security-supply-chains\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST — Software Security in Supply Chains\",\"description\":\"NIST guidance covering software supply-chain risk, provenance, verification, SBOM-related practices and vulnerability management.\"}},\"tunes\":{}}],\"version\":\"2.31.6\"}",{"time":1727,"blocks":1728,"version":2978},1791495428517,[1729,1733,1738,1743,1748,1753,1757,1761,1765,1769,1773,1777,1781,1785,1789,1793,1822,1826,1830,1834,1838,1842,1878,1882,1886,1890,1915,1920,1924,1961,1965,1969,1973,1977,1981,1985,1989,1993,1997,2001,2005,2009,2013,2017,2021,2058,2062,2066,2070,2074,2078,2082,2086,2090,2094,2101,2105,2109,2113,2117,2121,2125,2129,2133,2137,2141,2145,2149,2153,2157,2161,2165,2169,2173,2177,2181,2185,2189,2193,2197,2201,2230,2234,2238,2242,2246,2250,2254,2258,2262,2266,2270,2274,2278,2282,2287,2324,2328,2332,2336,2340,2344,2387,2391,2395,2399,2403,2407,2449,2453,2457,2461,2465,2469,2473,2477,2481,2485,2490,2494,2498,2502,2527,2531,2556,2560,2564,2568,2609,2613,2668,2672,2715,2719,2756,2760,2764,2768,2772,2776,2780,2784,2788,2792,2796,2800,2804,2808,2812,2819,2823,2858,2862,2899,2903,2907,2911,2915,2919,2923,2929,2936,2943,2950,2957,2964,2971],{"id":215,"data":1730,"type":218,"tunes":1732},{"text":1731},"Air-gapped AI is an AI system deployed inside a security domain that has no physical network connection to the external systems it is separated from, with any transfer across that boundary performed through deliberately controlled, non-automated procedures. The AI model, runtime, data, retrieval indexes, tools and operational dependencies required for inference must therefore be available inside the isolated environment. Air-gapped AI is not simply “a local model” or “an on-premise server”: the defining property is the network and transfer boundary around the complete system.",{},{"id":221,"data":1734,"type":226,"tunes":1737},{"body":1735,"title":1736,"variant":225},"An air-gapped AI system can run LLM inference, RAG, document analysis and even agentic workflows without internet or cloud APIs if every required dependency is available inside the isolated domain.\u003Cbr>\u003Cbr>A practical architecture is:\u003Cbr>\u003Cstrong>controlled import → internal artifact\u002Fmodel repositories → local AI runtime → local data\u002FRAG → local tools → internal users\u002Fservices → local monitoring\u002Faudit\u003C\u002Fstrong>.\u003Cbr>\u003Cbr>The difficult part is not making one LLM answer offline. It is operating the whole AI lifecycle — updates, models, drivers, packages, data imports, credentials, logging and security — without silently depending on external services.","Direct answer",{},{"id":229,"data":1739,"type":226,"tunes":1742},{"body":1740,"title":1741,"variant":233},"NIST's cybersecurity glossary defines an air gap as an interface where two systems are \u003Cstrong>not physically connected\u003C\u002Fstrong> and where any logical transfer is \u003Cstrong>not automated\u003C\u002Fstrong>; data crosses only manually under human control. Vendor documentation sometimes uses “air-gapped” or “disconnected” more broadly for environments with no outside-internet connection but with internal networking and controlled staging infrastructure. Architecture documentation should state which meaning is actually implemented.","Air gap has a stricter meaning than “no internet”",{},{"id":236,"data":1744,"type":226,"tunes":1747},{"body":1745,"title":1746,"variant":233},"Removing direct network connectivity eliminates many remote paths, but it does not eliminate malicious removable media, compromised software\u002Fmodel imports, insider threats, vulnerable internal services, physical compromise, prompt injection through imported documents or lateral movement inside the isolated network.","Air-gapped does not mean secure by definition",{},{"id":242,"data":1749,"type":226,"tunes":1752},{"body":1750,"title":1751,"variant":246},"Current NVIDIA NIM and Red Hat AI Inference documentation both support LLM serving without outside-internet access by pre-staging model and container assets. NVIDIA documents a connected preparation phase followed by an isolated execution phase with local assets and no cloud registry credentials. Red Hat uses mirrored container\u002Fmodel repositories for disconnected OpenShift environments. These are useful implementation examples, but they do not override the stricter NIST definition of an air gap.","Current-source note — 8 October 2026",{},{"id":249,"data":1754,"type":254,"tunes":1756},{"title":1755,"maxLevel":252,"minLevel":253},"Contents",{},{"id":257,"data":1758,"type":42,"tunes":1760},{"text":1759,"level":253},"What air-gapped AI really means",{},{"id":262,"data":1762,"type":218,"tunes":1764},{"text":1763},"The word AI does not change the basic security concept. An air gap is a boundary between security domains. AI simply makes the isolated side more operationally demanding because modern AI stacks normally assume downloadable models, package registries, telemetry, APIs, model hubs and frequent software updates.",{},{"id":267,"data":1766,"type":218,"tunes":1768},{"text":1767},"The isolated environment can still contain many connected machines. An internal cluster may have GPUs, application servers, storage, databases, identity services and monitoring connected to each other. The air gap exists between that enclave and the outside domain.",{},{"id":272,"data":1770,"type":218,"tunes":1772},{"text":1771},"The relevant question is therefore not “Does this GPU have Wi-Fi?” but “Can this AI environment exchange information with the external domain through an automated physical or logical path?”",{},{"id":277,"data":1774,"type":42,"tunes":1776},{"text":1775,"level":253},"The simplest example",{},{"id":282,"data":1778,"type":218,"tunes":1780},{"text":1779},"Imagine a company wants an internal assistant for confidential technical documents, but the environment is not permitted to send those documents to the internet.",{},{"id":287,"data":1782,"type":218,"tunes":1784},{"text":1783},"The company downloads an approved LLM, embedding model, container images and software packages in a connected staging environment. After validation, approved artifacts are transferred into the isolated environment.",{},{"id":292,"data":1786,"type":218,"tunes":1788},{"text":1787},"Inside the enclave, the model server, document parser, vector database, application and identity services run locally. Users can ask questions and use RAG against internal documents without a cloud model or public model registry.",{},{"id":297,"data":1790,"type":218,"tunes":1792},{"text":1791},"When an update is required, the update passes through the controlled import process again rather than being downloaded directly by the production AI server.",{},{"id":302,"data":1794,"type":331,"tunes":1821},{"steps":1795,"title":1820,"orientation":330},[1796,1799,1802,1805,1808,1811,1814,1817],{"label":1797,"description":1798},"1. Acquire outside the enclave","Download approved models, packages, containers, drivers, signatures and documentation in a connected staging environment.",{"label":1800,"description":1801},"2. Verify before transfer","Check provenance, signatures\u002Fchecksums, malware status, licensing and compatibility according to organizational policy.",{"label":1803,"description":1804},"3. Transfer through controlled boundary","Move approved artifacts using the authorized manual or mediated process.",{"label":1806,"description":1807},"4. Publish internally","Place artifacts in internal model, container, package or file repositories.",{"label":1809,"description":1810},"5. Deploy locally","Run inference, RAG, applications and tools without external dependencies.",{"label":1812,"description":1813},"6. Monitor inside the enclave","Collect logs, metrics, model\u002Fruntime status and security events locally.",{"label":1815,"description":1816},"7. Export only approved evidence","Move selected reports or artifacts outward through the reverse controlled process where policy permits.",{"label":1818,"description":1819},"8. Repeat for updates","Treat new models, patches, corpora and dependencies as new supply-chain imports.","A basic air-gapped AI operating cycle",{},{"id":334,"data":1823,"type":42,"tunes":1825},{"text":1824,"level":253},"Where the simple example stops",{},{"id":339,"data":1827,"type":218,"tunes":1829},{"text":1828},"A production air-gapped environment can be much larger than one workstation. It may include Kubernetes\u002FOpenShift, internal registries, object storage, identity providers, vector databases, observability, backup infrastructure and several model-serving nodes.",{},{"id":344,"data":1831,"type":218,"tunes":1833},{"text":1832},"The more services exist inside the enclave, the more the organization must reproduce capabilities that connected environments normally consume from the internet.",{},{"id":349,"data":1835,"type":218,"tunes":1837},{"text":1836},"Air-gapping therefore shifts complexity. It reduces direct external connectivity but increases artifact-management, patching, dependency, supply-chain and operational responsibility inside the isolated domain.",{},{"id":354,"data":1839,"type":42,"tunes":1841},{"text":1840,"level":253},"Air-gapped vs offline vs local vs on-premises vs private vs sovereign AI",{},{"id":359,"data":1843,"type":394,"tunes":1877},{"content":1844,"stretched":43,"withHeadings":14},[1845,1849,1853,1857,1861,1865,1869,1873],[1846,1847,1848],"Term","What it primarily describes","Internet\u002Fexternal connectivity required?",[1850,1851,1852],"Local AI","Inference\u002Fruntime runs on local hardware","No; but it may still call cloud services",[1854,1855,1856],"Offline-capable AI","Can continue operating without internet","No during offline operation; reconnection may be normal",[1858,1859,1860],"Disconnected environment","No direct external-internet path from deployment environment","Usually no; may use controlled mirrors\u002Fbastions",[1862,1863,1864],"On-premises AI","Infrastructure runs in an organization's own\u002Fon-prem environment","Could still have full internet connectivity",[1866,1867,1868],"Private AI","AI processing is controlled to meet privacy\u002Fconfidentiality requirements","Architecture-specific; can be connected or disconnected",[1870,1871,1872],"Air-gapped AI","Security domains are physically disconnected and cross-boundary transfer is non-automated\u002Fmanual under strict definition","No automated external path",[1874,1875,1876],"Sovereign AI","Control\u002Fjurisdiction over models, data, infrastructure and dependencies","Not necessarily; sovereignty is broader than network isolation",{},{"id":397,"data":1879,"type":218,"tunes":1881},{"text":1880},"These terms can overlap but are not synonyms. A local Ollama server connected to the internet is local AI, not air-gapped AI. An on-premises RAG platform that calls a cloud model is on-premises application infrastructure with cloud inference, not air-gapped AI.",{},{"id":402,"data":1883,"type":218,"tunes":1885},{"text":1884},"An air-gapped system is often private by design because data remains inside the enclave, but privacy also depends on authorization, logging, data handling, physical security and operational policy.",{},{"id":407,"data":1887,"type":42,"tunes":1889},{"text":1888,"level":253},"Strict air gap vs practical disconnected deployment",{},{"id":412,"data":1891,"type":444,"tunes":1914},{"rows":1892,"title":1908,"layout":394,"columns":1909},[1893,1896,1899,1902,1905],{"id":416,"label":1894,"values":1895},"External physical connection",{"strict":419,"disconnected":419},{"id":421,"label":1897,"values":1898},"Cross-boundary transfer",{"strict":419,"disconnected":419},{"id":425,"label":1900,"values":1901},"Internet access from AI workload",{"strict":419,"disconnected":419},{"id":429,"label":1903,"values":1904},"Internal networking",{"strict":419,"disconnected":419},{"id":433,"label":1906,"values":1907},"Use term when",{"strict":419,"disconnected":419},"Two meanings frequently called “air-gapped”",[1910,1912],{"id":439,"label":1911},"Strict air gap",{"id":442,"label":1913},"Disconnected \u002F no-internet deployment",{},{"id":447,"data":1916,"type":226,"tunes":1919},{"body":1917,"title":1918,"variant":451},"For architecture and security reviews, write the actual rule: \u003Cstrong>no outbound internet\u003C\u002Fstrong>, \u003Cstrong>no physical external network path\u003C\u002Fstrong>, \u003Cstrong>manual transfer only\u003C\u002Fstrong>, or \u003Cstrong>disconnected cluster with approved bastion\u002Fmirror\u003C\u002Fstrong>. That is more precise than saying only “air-gapped.”","Document the boundary instead of relying on the label",{},{"id":454,"data":1921,"type":42,"tunes":1923},{"text":1922,"level":253},"A practical air-gapped AI architecture",{},{"id":459,"data":1925,"type":394,"tunes":1960},{"content":1926,"stretched":43,"withHeadings":14},[1927,1930,1933,1936,1939,1942,1945,1948,1951,1954,1957],[1928,1929],"Layer","What must exist inside the isolated environment",[1931,1932],"User\u002Fapplication layer","Chat UI, APIs, business application or internal agent interface",[1934,1935],"Identity & authorization","Local\u002Finternal authentication, RBAC, tenant\u002Fresource permissions",[1937,1938],"AI gateway\u002Fruntime","Model routing, request policy, context assembly and runtime controls",[1940,1941],"Model serving","Local model server(s), weights, tokenizer\u002Fconfig and accelerator runtime",[1943,1944],"RAG \u002F knowledge","Document store, parser, embeddings, vector\u002Flexical indexes, metadata and provenance",[1946,1947],"Tools\u002Fservices","Only internal\u002Flocal APIs and approved systems reachable from the enclave",[1949,1950],"Artifact repositories","Local container registry, package mirror, model store and optionally OS\u002Fupdate repositories",[1952,1953],"Observability","Internal logs, metrics, traces and audit records",[1955,1956],"Backup\u002Frecovery","Local or separately controlled backup process appropriate to the security domain",[1958,1959],"Transfer boundary","Controlled import\u002Fexport process with inspection and approval",{},{"id":497,"data":1962,"type":218,"tunes":1964},{"text":1963},"A complete architecture should be able to start and operate without DNS lookups, license checks, package downloads or API calls to public services unless those dependencies have approved internal replacements.",{},{"id":502,"data":1966,"type":218,"tunes":1968},{"text":1967},"A useful design test is to disconnect the deployment from every external service and cold-start the stack. Hidden dependencies tend to appear during startup, model loading, authentication, package resolution or telemetry initialization.",{},{"id":507,"data":1970,"type":42,"tunes":1972},{"text":1971,"level":253},"Models must be pre-staged",{},{"id":512,"data":1974,"type":218,"tunes":1976},{"text":1975},"Cloud model APIs are unavailable by definition if the isolated workload has no path to them. The enclave therefore needs locally runnable model artifacts or an internally hosted inference service.",{},{"id":517,"data":1978,"type":218,"tunes":1980},{"text":1979},"NVIDIA's current NIM air-gap documentation explicitly uses a two-phase pattern: download and prepare model assets on a connected machine, transfer them, then run the isolated NIM from local storage without outbound registry access or cloud API keys.",{},{"id":522,"data":1982,"type":218,"tunes":1984},{"text":1983},"Model weights are only part of the dependency set. Tokenizers, configuration files, adapters, quantization metadata and any required runtime code must also be present.",{},{"id":527,"data":1986,"type":42,"tunes":1988},{"text":1987,"level":253},"Models with remote-code dependencies are an air-gap hazard",{},{"id":532,"data":1990,"type":218,"tunes":1992},{"text":1991},"Some model repositories contain custom Python code or runtime hooks that normally fetch additional code or assets.",{},{"id":537,"data":1994,"type":218,"tunes":1996},{"text":1995},"Current Red Hat AI Inference documentation explicitly warns that some Hugging Face models requiring remote code cannot operate normally in disconnected environments because the library attempts network access even when offline mode is configured.",{},{"id":542,"data":1998,"type":218,"tunes":2000},{"text":1999},"The practical lesson is to test a model's entire loading path offline before approving it for an isolated deployment. “I downloaded the weights” is not proof that the model is self-contained.",{},{"id":547,"data":2002,"type":42,"tunes":2004},{"text":2003,"level":253},"Containers, packages and drivers become local supply-chain artifacts",{},{"id":552,"data":2006,"type":218,"tunes":2008},{"text":2007},"Connected environments routinely pull container images, Python packages, OS updates and GPU components from public registries. An air-gapped environment cannot assume any of those services.",{},{"id":557,"data":2010,"type":218,"tunes":2012},{"text":2011},"Red Hat's disconnected AI deployment model uses internal mirror registries for container images and operator catalogs. Models can be mirrored as OCI artifacts or transferred to persistent storage.",{},{"id":562,"data":2014,"type":218,"tunes":2016},{"text":2015},"For broader stacks, the same pattern often applies to language packages, Linux repositories, JavaScript packages and internal binaries: approved artifacts enter once through the transfer process and are then served from trusted internal repositories.",{},{"id":567,"data":2018,"type":42,"tunes":2020},{"text":2019,"level":253},"Know the complete dependency bill",{},{"id":572,"data":2022,"type":394,"tunes":2057},{"content":2023,"stretched":43,"withHeadings":14},[2024,2027,2030,2033,2036,2039,2042,2045,2048,2051,2054],[2025,2026],"Dependency class","Examples",[2028,2029],"Model artifacts","Weights, tokenizer, config, adapters, quantization metadata",[2031,2032],"Inference runtime","vLLM, llama.cpp, Ollama, NIM or other serving runtime",[2034,2035],"GPU\u002Fruntime stack","Drivers, CUDA\u002FROCm libraries, container runtime",[2037,2038],"Application packages","Python wheels, npm packages, system libraries",[2040,2041],"Containers","Application, inference, DB, vector DB, monitoring images",[2043,2044],"RAG models","Embedding model, reranker, OCR\u002Fvision models",[2046,2047],"Data","Knowledge corpus, metadata, schemas, evaluation datasets",[2049,2050],"Security material","Certificates, CA bundles, policy\u002Fconfiguration, malware signatures where applicable",[2052,2053],"Operational artifacts","Dashboards, alert rules, backup tools, runbooks",[2055,2056],"Licensing","Offline-compatible licenses\u002Fentitlements where required",{},{"id":610,"data":2059,"type":42,"tunes":2061},{"text":2060,"level":253},"Internal mirrors are infrastructure, not a convenience",{},{"id":615,"data":2063,"type":218,"tunes":2065},{"text":2064},"A disconnected deployment becomes maintainable when the isolated domain has known internal sources for approved artifacts.",{},{"id":620,"data":2067,"type":218,"tunes":2069},{"text":2068},"Red Hat's documented approach uses a mirror registry available to the disconnected cluster so workloads do not need public registries.",{},{"id":625,"data":2071,"type":218,"tunes":2073},{"text":2072},"The same architectural idea can be applied to model stores and package repositories. The objective is to make artifact origin, version and approval explicit rather than copy random files manually to each server.",{},{"id":630,"data":2075,"type":42,"tunes":2077},{"text":2076,"level":253},"RAG can work fully air-gapped",{},{"id":635,"data":2079,"type":218,"tunes":2081},{"text":2080},"RAG does not require the public internet. It requires a retrievable corpus, an ingestion\u002Findexing pipeline and a model that can use the retrieved context.",{},{"id":640,"data":2083,"type":218,"tunes":2085},{"text":2084},"Inside an air-gapped environment, the document store, parser\u002FOCR, embedding model, vector or lexical index, reranker and generation model can all run locally.",{},{"id":645,"data":2087,"type":218,"tunes":2089},{"text":2088},"What changes is source acquisition. Live web search and cloud document connectors are unavailable unless equivalent data is imported through the controlled boundary.",{},{"id":650,"data":2091,"type":218,"tunes":2093},{"text":2092},"The corpus therefore becomes a governed artifact. Every import should preserve source identity, date\u002Fversion and provenance so users know what knowledge the isolated system actually contains.",{},{"id":655,"data":2095,"type":661,"tunes":2100},{"url":2096,"title":2097,"excerpt":2098,"ctaLabel":2099},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works","What Is RAG? The Simplest Explanation of How It Works","RAG itself is independent of cloud hosting. In an air-gapped architecture, retrieval and generation simply have to be supplied by local\u002Finternal components.","Read the RAG foundation",{},{"id":664,"data":2102,"type":42,"tunes":2104},{"text":2103,"level":253},"Agents can run air-gapped — but only with reachable tools",{},{"id":669,"data":2106,"type":218,"tunes":2108},{"text":2107},"An agent loop can run entirely inside an isolated enclave if the model\u002Fruntime and required tools are local or reachable on the internal network.",{},{"id":674,"data":2110,"type":218,"tunes":2112},{"text":2111},"A tool that depends on GitHub, public web search, cloud email or an external SaaS API will fail unless the architecture provides an approved internal equivalent or controlled asynchronous exchange process.",{},{"id":679,"data":2114,"type":218,"tunes":2116},{"text":2115},"This is why air-gapped agent design should begin with a capability inventory: every tool endpoint must be classified as internal, imported, unavailable or deliberately excluded.",{},{"id":684,"data":2118,"type":42,"tunes":2120},{"text":2119,"level":253},"MCP does not bypass the air gap",{},{"id":689,"data":2122,"type":218,"tunes":2124},{"text":2123},"MCP can expose local tools and resources inside an isolated AI environment, but the protocol does not create connectivity through the security boundary.",{},{"id":694,"data":2126,"type":218,"tunes":2128},{"text":2127},"A local MCP server that reads internal documents can work perfectly offline. A remote MCP server on the public internet cannot be reached from a strict air-gapped enclave.",{},{"id":699,"data":2130,"type":218,"tunes":2132},{"text":2131},"The same principle applies to any connector protocol: interoperability is separate from network authority.",{},{"id":704,"data":2134,"type":42,"tunes":2136},{"text":2135,"level":253},"Identity and authentication must also work offline",{},{"id":709,"data":2138,"type":218,"tunes":2140},{"text":2139},"An AI application can be locally hosted while still depending on a cloud identity provider. That hidden dependency breaks truly disconnected operation.",{},{"id":714,"data":2142,"type":218,"tunes":2144},{"text":2143},"Air-gapped designs therefore need an identity architecture that functions inside the enclave: local directory, internal identity provider, internal PKI, local service credentials or another approved mechanism.",{},{"id":719,"data":2146,"type":218,"tunes":2148},{"text":2147},"Authorization remains necessary even though the internet is absent. Air gaps do not replace RBAC, tenant isolation or least privilege.",{},{"id":724,"data":2150,"type":42,"tunes":2152},{"text":2151,"level":253},"Time, certificates and trust stores become local dependencies",{},{"id":729,"data":2154,"type":218,"tunes":2156},{"text":2155},"Many authentication and logging systems depend on reliable time. Certificates expire. Trust stores change. Signed artifacts need validation.",{},{"id":734,"data":2158,"type":218,"tunes":2160},{"text":2159},"A disconnected enclave should therefore have internal time synchronization and a certificate\u002Ftrust lifecycle that does not depend on reaching public services during ordinary operation.",{},{"id":739,"data":2162,"type":218,"tunes":2164},{"text":2163},"These are ordinary infrastructure concerns that become visible only when an architecture is tested without internet access.",{},{"id":744,"data":2166,"type":42,"tunes":2168},{"text":2167,"level":253},"Telemetry and crash reporting need explicit policy",{},{"id":749,"data":2170,"type":218,"tunes":2172},{"text":2171},"Many modern libraries attempt analytics, update checks or error reporting by default.",{},{"id":754,"data":2174,"type":218,"tunes":2176},{"text":2175},"In an isolated environment those calls should either be disabled or redirected to internal observability. Repeated failed telemetry attempts can create delays, noisy logs and unexpected startup behavior.",{},{"id":759,"data":2178,"type":218,"tunes":2180},{"text":2179},"An air-gapped deployment should know which components attempt egress even if the firewall would block them.",{},{"id":764,"data":2182,"type":42,"tunes":2184},{"text":2183,"level":253},"Air-gapped systems still need patches",{},{"id":769,"data":2186,"type":218,"tunes":2188},{"text":2187},"Network isolation does not stop software from developing vulnerabilities. It only changes how patches reach the system.",{},{"id":774,"data":2190,"type":218,"tunes":2192},{"text":2191},"NIST frames patch management as preventive maintenance: organizations still need to identify, acquire, prioritize, install and verify patches and updates.",{},{"id":779,"data":2194,"type":218,"tunes":2196},{"text":2195},"Air-gapped operations therefore need a repeatable import cadence for OS packages, container images, drivers, AI runtimes and security updates. The trade-off is between isolation stability and vulnerability exposure from stale software.",{},{"id":784,"data":2198,"type":42,"tunes":2200},{"text":2199,"level":253},"A controlled update path",{},{"id":789,"data":2202,"type":331,"tunes":2229},{"steps":2203,"title":2228,"orientation":330},[2204,2207,2210,2213,2216,2219,2222,2225],{"label":2205,"description":2206},"1. Identify required update","Security advisory, model\u002Fruntime improvement or operational need triggers change.",{"label":2208,"description":2209},"2. Acquire in connected staging","Download exact versions plus signatures\u002Fchecksums and metadata.",{"label":2211,"description":2212},"3. Validate supply-chain evidence","Verify source, integrity, compatibility and policy requirements.",{"label":2214,"description":2215},"4. Test in representative offline staging","Confirm the update works without unexpected network dependencies.",{"label":2217,"description":2218},"5. Approve transfer","Apply the organization's change and security process.",{"label":2220,"description":2221},"6. Import into enclave repository","Publish the artifact to the internal trusted source.",{"label":2223,"description":2224},"7. Deploy gradually","Apply to test\u002Fcanary nodes before wider rollout where architecture permits.",{"label":2226,"description":2227},"8. Verify and record","Confirm version, health, behavior and rollback state.","Example update lifecycle for an isolated AI environment",{},{"id":819,"data":2231,"type":42,"tunes":2233},{"text":2232,"level":253},"The transfer boundary is the most sensitive operational interface",{},{"id":824,"data":2235,"type":218,"tunes":2237},{"text":2236},"If external information must enter an air-gapped system, the import channel becomes a major security control point.",{},{"id":829,"data":2239,"type":218,"tunes":2241},{"text":2240},"The NSA Cybersecurity Technical Cyber Threat Framework explicitly recognizes replication through removable media as a path adversaries can use to cross into disconnected or air-gapped networks.",{},{"id":834,"data":2243,"type":218,"tunes":2245},{"text":2244},"That is why controlled media handling, inspection, provenance, encryption where required, malware scanning and role separation can matter as much as the AI stack itself.",{},{"id":839,"data":2247,"type":42,"tunes":2249},{"text":2248,"level":253},"Removable media is not a neutral pipe",{},{"id":844,"data":2251,"type":218,"tunes":2253},{"text":2252},"USB drives and other portable media can carry both legitimate model\u002Fdata artifacts and malicious content.",{},{"id":849,"data":2255,"type":218,"tunes":2257},{"text":2256},"NIST's media-sanitization guidance treats storage media as a confidentiality lifecycle object that may require clearing, purging or destruction according to sensitivity and reuse needs.",{},{"id":854,"data":2259,"type":218,"tunes":2261},{"text":2260},"The exact transfer procedure is organization-specific, but the architectural principle is stable: cross-boundary media should be governed as a security asset, not treated as an informal convenience.",{},{"id":859,"data":2263,"type":42,"tunes":2265},{"text":2264,"level":253},"Air-gapping increases supply-chain importance",{},{"id":864,"data":2267,"type":218,"tunes":2269},{"text":2268},"An isolated system receives fewer live external inputs, but every imported binary, model, container and package becomes more consequential because the enclave may trust it for a long time.",{},{"id":869,"data":2271,"type":218,"tunes":2273},{"text":2272},"NIST software-supply-chain guidance emphasizes provenance, supplier risk, vulnerability management, software verification and SBOM-oriented practices. These concerns become directly relevant to offline AI artifact import.",{},{"id":874,"data":2275,"type":218,"tunes":2277},{"text":2276},"Model supply chain deserves the same attention as application supply chain: model origin, license, hash, format, required code, tokenizer, adapters and evaluation status should be known before import.",{},{"id":879,"data":2279,"type":42,"tunes":2281},{"text":2280,"level":253},"Air-gap readiness should be tested, not assumed",{},{"id":884,"data":2283,"type":226,"tunes":2286},{"body":2284,"title":2285,"variant":246},"The following air-gap-readiness test is an engineering synthesis, not a NIST or vendor certification method. It is designed to expose hidden external dependencies before deployment.","Proposed validation pattern",{},{"id":890,"data":2288,"type":394,"tunes":2323},{"content":2289,"stretched":43,"withHeadings":14},[2290,2293,2296,2299,2302,2305,2308,2311,2314,2317,2320],[2291,2292],"Test","What it proves",[2294,2295],"Cold start with all outbound network blocked","Runtime does not require public services during startup",[2297,2298],"Load every approved model from local storage","Weights\u002Ftokenizers\u002Fconfigs are complete",[2300,2301],"Rebuild\u002Fredeploy from internal registries only","Container\u002Fpackage mirrors are sufficient",[2303,2304],"Authenticate users while external IdP is unreachable","Identity works inside the enclave",[2306,2307],"Run RAG ingestion and query offline","Embedding\u002Findexing\u002Fretrieval stack is local",[2309,2310],"Run representative agent tools","Tools do not depend on external APIs",[2312,2313],"Restart after cache deletion","Offline operation is not accidentally relying on previously cached downloads",[2315,2316],"Advance simulated certificate\u002Fupdate lifecycle","Trust and maintenance dependencies are understood",[2318,2319],"Import a new model through staging path","Transfer\u002Fchange procedure is operational",[2321,2322],"Restore from backup","Recovery does not require unavailable cloud storage",{},{"id":928,"data":2325,"type":42,"tunes":2327},{"text":2326,"level":253},"Cached once is not the same as air-gap ready",{},{"id":933,"data":2329,"type":218,"tunes":2331},{"text":2330},"A system may appear offline because the model and packages are already cached from earlier internet access.",{},{"id":938,"data":2333,"type":218,"tunes":2335},{"text":2334},"Deleting caches or deploying to a clean node can reveal missing tokenizer files, Python packages, model manifests or remote-code dependencies.",{},{"id":943,"data":2337,"type":218,"tunes":2339},{"text":2338},"Air-gap readiness should therefore be validated from clean internal artifacts, not only from a developer workstation that was previously connected.",{},{"id":948,"data":2341,"type":42,"tunes":2343},{"text":2342,"level":253},"What threats remain inside an air gap?",{},{"id":953,"data":2345,"type":394,"tunes":2386},{"content":2346,"stretched":43,"withHeadings":14},[2347,2350,2353,2356,2359,2362,2365,2368,2371,2374,2377,2380,2383],[2348,2349],"Threat","Why the air gap does not remove it",[2351,2352],"Compromised imported artifact","Malware\u002Fmodel\u002Fpackage can enter through the authorized transfer path",[2354,2355],"Malicious removable media","Physical transfer can carry executable payloads",[2357,2358],"Insider misuse","Authorized users already exist inside the enclave",[2360,2361],"Prompt injection in imported documents","Untrusted content can influence RAG\u002Fagents without internet",[2363,2364],"Overprivileged agent tools","Local tools can still damage local systems",[2366,2367],"Cross-tenant data leakage","Internal authorization bugs remain possible",[2369,2370],"Vulnerable internal software","Lack of external connection does not remove exploitable bugs",[2372,2373],"Lateral movement","A compromised node can attack other internally connected nodes",[2375,2376],"Stale dependencies","Slow update cadence can leave known vulnerabilities unpatched",[2378,2379],"Physical theft\u002Ftampering","Hardware and media security remain critical",[2381,2382],"Bad model behavior","Hallucination, bias and task failure are independent of networking",[2384,2385],"Supply-chain poisoning","Trusted import sources can still be compromised",{},{"id":997,"data":2388,"type":42,"tunes":2390},{"text":2389,"level":253},"What an air gap actually improves",{},{"id":1002,"data":2392,"type":218,"tunes":2394},{"text":2393},"A genuine air gap can materially reduce attack paths that depend on direct remote connectivity: external command-and-control, cloud credential misuse, internet-facing service exploitation and accidental data exfiltration through ordinary outbound APIs.",{},{"id":1007,"data":2396,"type":218,"tunes":2398},{"text":2397},"It also makes data residency simple in one narrow sense: inference data cannot be sent to an external cloud service if no path exists.",{},{"id":1012,"data":2400,"type":218,"tunes":2402},{"text":2401},"Those benefits are strongest when the transfer boundary and internal access controls are equally disciplined. A poorly managed USB process can undermine the intended isolation.",{},{"id":1017,"data":2404,"type":42,"tunes":2406},{"text":2405,"level":253},"What an air gap makes harder",{},{"id":1022,"data":2408,"type":394,"tunes":2448},{"content":2409,"stretched":43,"withHeadings":14},[2410,2413,2416,2419,2422,2425,2428,2431,2434,2436,2439,2442,2445],[2411,2412],"Area","Operational consequence",[2414,2415],"Model updates","Manual\u002Fstaged transfer instead of direct model-hub pull",[2417,2418],"Security patches","Delayed and governed import workflow",[2420,2421],"Package installation","Internal mirrors or prebuilt artifacts required",[2423,2424],"Cloud AI APIs","Unavailable",[2426,2427],"Web search\u002Fconnectors","Unavailable unless data is imported separately",[2429,2430],"Authentication","Needs internal\u002Foffline-capable identity services",[2432,2433],"Monitoring","Needs internal observability and controlled export",[2055,2435],"Products requiring online activation may be unsuitable",[2437,2438],"Troubleshooting","No easy live access to vendor resources from production enclave",[2440,2441],"Capacity","All inference compute must exist locally",[2443,2444],"Disaster recovery","Cloud backups may be unavailable or policy-restricted",[2446,2447],"Knowledge freshness","External information arrives only as fast as the import process",{},{"id":1066,"data":2450,"type":42,"tunes":2452},{"text":2451,"level":253},"Air-gapped AI vs private AI",{},{"id":1071,"data":2454,"type":218,"tunes":2456},{"text":2455},"Private AI is primarily about controlling sensitive data and AI processing. A private AI platform may be on-premises and still access approved cloud models or external services.",{},{"id":1076,"data":2458,"type":218,"tunes":2460},{"text":2459},"Air-gapped AI is stricter on connectivity. A system can be private without being air-gapped, and an air-gapped system can still have poor privacy if every internal user has unrestricted access.",{},{"id":1081,"data":2462,"type":218,"tunes":2464},{"text":2463},"The security objective should determine the architecture: confidentiality, sovereignty, resilience and isolation are related but distinct requirements.",{},{"id":1086,"data":2466,"type":42,"tunes":2468},{"text":2467,"level":253},"Air-gapped AI vs sovereign AI",{},{"id":1091,"data":2470,"type":218,"tunes":2472},{"text":2471},"Sovereign AI concerns control over the broader dependency chain: data, models, infrastructure, operators, jurisdiction and strategic dependencies.",{},{"id":1096,"data":2474,"type":218,"tunes":2476},{"text":2475},"An air gap can support sovereignty by reducing external runtime dependency, but it does not guarantee sovereign control. The enclave may still depend on foreign hardware, proprietary model licenses or external update suppliers.",{},{"id":1101,"data":2478,"type":218,"tunes":2480},{"text":2479},"The next canonical article separates those control dimensions explicitly.",{},{"id":1106,"data":2482,"type":42,"tunes":2484},{"text":2483,"level":253},"Original implementation evidence: what the Aaasaasa AI Client proves — and what it does not",{},{"id":1111,"data":2486,"type":226,"tunes":2489},{"body":2487,"title":2488,"variant":246},"Aaasaasa AI Client is useful evidence for \u003Cstrong>local inference architecture\u003C\u002Fstrong>, provider abstraction and separation of runtime\u002Fmodel location. It is \u003Cstrong>not evidence of a deployed air-gapped environment\u003C\u002Fstrong>. The repository also supports cloud and remote paths, and no verified project evidence establishes a physically isolated security domain.","Implementation boundary",{},{"id":1117,"data":2491,"type":218,"tunes":2493},{"text":2492},"The AI Hub separates agent\u002Fclient, provider, model and connection location. It supports local Ollama inference and local-provider Codex operation as distinct choices rather than assuming that every AI request goes to a cloud model.",{},{"id":1122,"data":2495,"type":218,"tunes":2497},{"text":2496},"The repository explicitly notes that a local runtime can still use a cloud model, while Direct Ollama chat is local inference. This distinction is directly relevant to air-gap architecture: local execution does not prove that the model or surrounding dependencies are disconnected.",{},{"id":1127,"data":2499,"type":218,"tunes":2501},{"text":2500},"Provider abstraction, local model discovery and local inference are therefore building blocks for an air-gap-capable product architecture, but the network boundary, offline dependency mirror, controlled transfer process and offline identity\u002Foperations must still be engineered separately.",{},{"id":1132,"data":2503,"type":394,"tunes":2526},{"content":2504,"stretched":43,"withHeadings":14},[2505,2508,2511,2514,2517,2520,2523],[2506,2507],"Verified project capability","Air-gap relevance",[2509,2510],"Local Ollama inference","Supports local model execution",[2512,2513],"Local provider\u002Fruntime paths","Reduces dependency on cloud inference",[2515,2516],"Provider\u002Fmodel\u002Fruntime separation","Makes cloud dependencies explicit rather than hidden",[2518,2519],"Central permissions","Supports local tool\u002Fdata access control",[2521,2522],"Cloud\u002Fremote provider support also exists","Proves the product itself is hybrid-capable, not inherently air-gapped",[2524,2525],"No verified isolated deployment boundary","Prevents overclaiming air-gap maturity",{},{"id":1158,"data":2528,"type":42,"tunes":2530},{"text":2529,"level":253},"When is air-gapped AI justified?",{},{"id":1163,"data":2532,"type":394,"tunes":2555},{"content":2533,"stretched":43,"withHeadings":14},[2534,2537,2540,2543,2546,2549,2552],[2535,2536],"Air gap may be justified when","A connected private architecture may be better when",[2538,2539],"Security policy explicitly requires physically separated domains","Main requirement is only that prompts\u002Fdata are not used by public consumer services",[2541,2542],"Classified or extremely sensitive data cannot cross external networks","Approved enterprise cloud\u002Fprivate endpoints satisfy data controls",[2544,2545],"Operational environment has no reliable external connectivity","Internet is available and operational agility matters",[2547,2548],"Mission continuity must not depend on cloud\u002Fprovider availability","Managed model quality and rapid upgrades are more valuable",[2550,2551],"Regulated\u002Fcritical environment mandates controlled transfer","Standard security controls can meet the actual threat model",[2553,2554],"External SaaS\u002FAPI access is prohibited","Business workflow relies heavily on external connectors",{},{"id":1189,"data":2557,"type":218,"tunes":2559},{"text":2558},"Air-gapping should be a requirement derived from a threat model or policy, not a prestige feature. It has real security value when the eliminated connectivity path is itself unacceptable.",{},{"id":1194,"data":2561,"type":218,"tunes":2563},{"text":2562},"For many enterprise use cases, a tightly controlled private network with egress restrictions, local inference and approved update channels may provide a better balance of security and maintainability than a strict physical air gap.",{},{"id":1199,"data":2565,"type":42,"tunes":2567},{"text":2566,"level":253},"A practical air-gapped AI design sequence",{},{"id":1204,"data":2569,"type":331,"tunes":2608},{"steps":2570,"title":2607,"orientation":330},[2571,2574,2577,2580,2583,2586,2589,2592,2595,2598,2601,2604],{"label":2572,"description":2573},"1. Define what the air gap separates","Name the security domains and whether the requirement is strict physical separation or simply no internet.",{"label":2575,"description":2576},"2. Inventory every external dependency","Models, packages, registries, identity, telemetry, licensing, storage, APIs, DNS\u002Ftime and support services.",{"label":2578,"description":2579},"3. Select offline-capable models and runtimes","Verify model assets and runtime code can load without remote calls.",{"label":2581,"description":2582},"4. Build internal artifact repositories","Create trusted sources for containers, packages, models and updates.",{"label":2584,"description":2585},"5. Design controlled transfer","Define staging, verification, media\u002Fgateway handling, approval and provenance.",{"label":2587,"description":2588},"6. Build internal identity and authorization","Ensure users, services and tools can authenticate without cloud dependencies.",{"label":2590,"description":2591},"7. Keep RAG and tools local","Deploy knowledge, embeddings, indexes and required service APIs inside the enclave.",{"label":2593,"description":2594},"8. Build internal observability","Operate logs, metrics, traces and security monitoring locally.",{"label":2596,"description":2597},"9. Define patch\u002Fmodel update cadence","Balance vulnerability response with the controlled import process.",{"label":2599,"description":2600},"10. Test from a clean disconnected state","Cold-start and operate without inherited caches or hidden internet access.",{"label":2602,"description":2603},"11. Test compromise paths","Exercise removable-media, supply-chain, prompt-injection, insider and lateral-movement scenarios.",{"label":2605,"description":2606},"12. Document exceptions and exports","Every permitted cross-boundary path should have a named purpose, owner and control set.","Design from the boundary inward",{},{"id":1246,"data":2610,"type":42,"tunes":2612},{"text":2611,"level":253},"Air-gapped AI architecture checklist",{},{"id":1251,"data":2614,"type":394,"tunes":2667},{"content":2615,"stretched":43,"withHeadings":14},[2616,2619,2622,2625,2628,2631,2634,2637,2640,2643,2646,2649,2652,2655,2658,2661,2664],[2617,2618],"Question","Expected evidence",[2620,2621],"What exactly is isolated from what?","Documented security-domain boundary",[2623,2624],"Is the boundary physically disconnected?","Network\u002Fphysical architecture evidence if strict air gap is claimed",[2626,2627],"How does data cross the boundary?","Authorized non-automated\u002Fmanual or explicitly documented disconnected workflow",[2629,2630],"Can every model cold-start offline?","Offline loading test",[2632,2633],"Are tokenizer\u002Fconfig\u002Fruntime assets complete?","Verified internal model bundle",[2635,2636],"Where do containers\u002Fpackages come from?","Internal trusted mirror\u002Frepository",[2638,2639],"Can identity work without cloud services?","Internal IdP\u002FPKI\u002Fservice credential path",[2641,2642],"Can RAG ingest\u002Fquery offline?","Local ingestion, embeddings, index and retrieval",[2644,2645],"Which agent tools remain available?","Internal capability inventory",[2647,2648],"How are patches imported?","Controlled maintenance process",[2650,2651],"How are artifacts verified?","Integrity\u002Fprovenance\u002Fmalware\u002Fsupply-chain controls",[2653,2654],"How is removable media governed?","Media handling and sanitization policy",[2656,2657],"Can the system run after caches are cleared?","Clean-environment offline test",[2659,2660],"Where are logs and traces stored?","Internal observability platform",[2662,2663],"How are exports approved?","Controlled egress process",[2665,2666],"What proves this is air-gapped rather than merely local?","Boundary and transfer evidence, not model location",{},{"id":1307,"data":2669,"type":42,"tunes":2671},{"text":2670,"level":253},"Common air-gapped AI failure modes",{},{"id":1312,"data":2673,"type":394,"tunes":2714},{"content":2674,"stretched":43,"withHeadings":14},[2675,2678,2681,2684,2687,2690,2693,2696,2699,2702,2705,2708,2711],[2676,2677],"Failure mode","What actually failed",[2679,2680],"Local model still downloads tokenizer\u002Fconfig at startup","Model bundle was incomplete",[2682,2683],"Container references public registry","Deployment was not self-contained",[2685,2686],"Cloud identity required for login","Application was local but identity was not",[2688,2689],"License server required externally","Vendor dependency contradicted offline operation",[2691,2692],"Embedding model missing","Chat works but RAG ingestion fails",[2694,2695],"Agent tool calls public SaaS","Agent architecture was not air-gap compatible",[2697,2698],"Only GPU node is isolated","Database, UI or monitoring still depends on external services",[2700,2701],"USB imports are informal","Transfer boundary becomes uncontrolled attack path",[2703,2704],"No patch process","Isolation creates growing vulnerability debt",[2706,2707],"Cached developer machine used as proof","Fresh deployment fails without internet",[2709,2710],"Air gap replaces authorization thinking","Internal users\u002Fservices become overprivileged",[2712,2713],"Air-gapped label used for firewall-only egress block","Security documentation overstates the actual boundary",{},{"id":1356,"data":2716,"type":42,"tunes":2718},{"text":2717,"level":253},"Common misconceptions",{},{"id":1361,"data":2720,"type":394,"tunes":2755},{"content":2721,"stretched":43,"withHeadings":14},[2722,2725,2728,2731,2734,2737,2740,2743,2746,2749,2752],[2723,2724],"Misconception","Correction",[2726,2727],"“Local AI is air-gapped AI.”","Local describes where inference runs; air gap describes the security\u002Fnetwork boundary.",[2729,2730],"“Air-gapped means one standalone PC.”","An isolated enclave can contain an entire internal network or cluster.",[2732,2733],"“No internet equals strict air gap.”","Under NIST's definition, the separated systems also lack physical connection and cross-boundary transfer is non-automated.",[2735,2736],"“Air gaps eliminate cyber risk.”","Supply-chain, removable-media, insider, internal-network and application risks remain.",[2738,2739],"“RAG needs the cloud.”","RAG can run entirely with local models, indexes and data.",[2741,2742],"“Agents cannot work offline.”","Agents can use internal\u002Flocal tools; they simply cannot reach unavailable external services.",[2744,2745],"“Once installed, the system needs no updates.”","Patches, drivers, models and dependencies still require lifecycle management.",[2747,2748],"“A downloaded model is self-contained.”","Tokenizers, remote code, libraries or model assets may still trigger network dependencies.",[2750,2751],"“Private AI and air-gapped AI are identical.”","Private AI is a data\u002Fcontrol property; air gap is a connectivity property.",[2753,2754],"“Air gap guarantees sovereignty.”","External hardware, licenses, models and supply chain can remain dependencies.",{},{"id":1399,"data":2757,"type":42,"tunes":2759},{"text":2758,"level":253},"Limitations",{},{"id":1404,"data":2761,"type":218,"tunes":2763},{"text":2762},"Strict air gaps make external knowledge freshness slower because every new source must pass through a transfer process.",{},{"id":1409,"data":2765,"type":218,"tunes":2767},{"text":2766},"They can constrain model choice when licenses, remote-code requirements, hardware needs or provider-only APIs cannot be satisfied offline.",{},{"id":1414,"data":2769,"type":218,"tunes":2771},{"text":2770},"They increase operational cost because infrastructure normally consumed as cloud services must be owned and maintained internally.",{},{"id":1419,"data":2773,"type":218,"tunes":2775},{"text":2774},"They can also create patch latency: stronger change control may keep systems stable while delaying urgent vulnerability remediation.",{},{"id":1424,"data":2777,"type":218,"tunes":2779},{"text":2778},"Air-gapped AI should therefore be evaluated as one security architecture among several, not assumed to be universally superior.",{},{"id":1429,"data":2781,"type":42,"tunes":2783},{"text":2782,"level":253},"What would change this answer?",{},{"id":1434,"data":2785,"type":218,"tunes":2787},{"text":2786},"Vendor support for disconnected operation changes quickly. New model formats, signed OCI artifacts, offline license mechanisms and integrated model registries can reduce operational friction.",{},{"id":1439,"data":2789,"type":218,"tunes":2791},{"text":2790},"The distinction between strict air gap and disconnected deployment will remain important even if vendors continue using the terms loosely.",{},{"id":1444,"data":2793,"type":218,"tunes":2795},{"text":2794},"The stable principle is that genuine air-gap claims depend on the system boundary and transfer mechanism, not on whether the LLM happens to run locally.",{},{"id":1449,"data":2797,"type":42,"tunes":2799},{"text":2798,"level":253},"Related canonical knowledge",{},{"id":1454,"data":2801,"type":218,"tunes":2803},{"text":2802},"Air-Gapped AI is a deployment\u002Fsecurity architecture node. Private AI, Sovereign AI and provider abstraction answer different questions about confidentiality, control and dependency.",{},{"id":1459,"data":2805,"type":218,"tunes":2807},{"text":2806},"MLOps\u002FLLMOps becomes more demanding inside a disconnected environment because model, package and update lifecycles must operate through internal repositories and controlled transfer.",{},{"id":1464,"data":2809,"type":218,"tunes":2811},{"text":2810},"RAG and Agentic AI remain valid patterns inside the enclave as long as their data and tools are internally available.",{},{"id":1469,"data":2813,"type":661,"tunes":2818},{"url":2814,"title":2815,"excerpt":2816,"ctaLabel":2817},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context","Air-gapped AI still needs correct internal boundaries between durable memory, authoritative state, retrieval and model context.","Read the memory architecture article",{},{"id":1477,"data":2820,"type":42,"tunes":2822},{"text":2821,"level":253},"Frequently asked questions",{},{"id":1482,"data":2824,"type":1482,"tunes":2857},{"items":2825,"title":2856},[2826,2829,2832,2835,2838,2841,2844,2847,2850,2853],{"id":1486,"answer":2827,"question":2828},"Air-gapped AI is AI deployed inside a security domain physically disconnected from the external systems it is separated from, with cross-boundary transfer performed through controlled non-automated procedures under the strict NIST definition.","What is air-gapped AI?",{"id":1490,"answer":2830,"question":2831},"No for normal inference and operation. Required models, packages, data and services must be available inside the isolated environment.","Does air-gapped AI need internet access?",{"id":1494,"answer":2833,"question":2834},"No. A local model can run on a machine that still has internet access or uses cloud identity, tools or storage. Air gap describes the complete system boundary.","Is a local LLM automatically air-gapped?",{"id":1498,"answer":2836,"question":2837},"Yes. Documents, embedding models, vector or lexical indexes, rerankers and generation models can all run locally. External knowledge must be imported through the controlled boundary.","Can RAG work in an air-gapped network?",{"id":1502,"answer":2839,"question":2840},"Yes, if their tools and required systems are available inside the isolated network. Public SaaS and cloud APIs are unavailable without a permitted cross-boundary mechanism.","Can AI agents work air-gapped?",{"id":1506,"answer":2842,"question":2843},"Models are typically acquired and validated in a connected staging environment, transferred through an approved process and published to an internal model\u002Fartifact repository.","How are models updated in an air-gapped environment?",{"id":1510,"answer":2845,"question":2846},"No. On-premises describes infrastructure location. On-prem systems can remain internet-connected.","Is on-premises AI the same as air-gapped AI?",{"id":1514,"answer":2848,"question":2849},"No. Private AI is about data\u002Fcontrol requirements and can still use connected infrastructure. Air gap specifically describes network\u002Fdomain separation.","Is private AI the same as air-gapped AI?",{"id":1518,"answer":2851,"question":2852},"It removes or reduces some remote connectivity risks but does not remove supply-chain, removable-media, insider, internal authorization, physical or model-behavior risks.","Does an air gap make AI secure?",{"id":1522,"answer":2854,"question":2855},"Deploy or cold-start the full stack in a clean environment with all external connectivity unavailable and verify that models, identity, RAG, tools, monitoring, updates and recovery depend only on approved internal artifacts and services.","What is the best test for air-gap readiness?","Air-gapped AI FAQ",{},{"id":1528,"data":2859,"type":42,"tunes":2861},{"text":2860,"level":253},"Glossary",{},{"id":1533,"data":2863,"type":1533,"tunes":2898},{"title":2864,"entries":2865},"Key air-gapped AI terms",[2866,2869,2871,2873,2875,2877,2880,2883,2886,2889,2892,2895],{"term":2867,"anchor":1539,"definition":2868},"Air gap","Security-domain interface where systems are not physically connected and any cross-boundary logical transfer is non-automated\u002Fmanual under the NIST glossary definition.",{"term":1870,"anchor":1543,"definition":2870},"AI system deployed inside an air-gapped security domain with locally available inference and operational dependencies.",{"term":1858,"anchor":1546,"definition":2872},"Deployment environment without direct outside-internet access; implementations may use controlled mirror or bastion workflows.",{"term":1854,"anchor":1549,"definition":2874},"AI application able to operate for some or all functions without internet connectivity, without necessarily being permanently isolated.",{"term":1850,"anchor":1552,"definition":2876},"AI inference or runtime executing on local hardware rather than a remote model endpoint; does not imply network isolation.",{"term":2878,"anchor":1556,"definition":2879},"Mirror registry","Internal repository containing approved copies of container images or other artifacts needed by a disconnected deployment.",{"term":2881,"anchor":1560,"definition":2882},"Staging environment","Connected or controlled zone where artifacts are acquired, verified and prepared before transfer into an isolated domain.",{"term":2884,"anchor":1564,"definition":2885},"Controlled transfer","Governed movement of data or software across the isolation boundary using approved media\u002Fprocesses and verification.",{"term":2887,"anchor":1568,"definition":2888},"Artifact provenance","Information showing where a model, package, container or other imported artifact originated and how it was produced or verified.",{"term":2890,"anchor":1572,"definition":2891},"Removable media","Portable storage used to transfer data between systems; a potential security path across disconnected domains.",{"term":2893,"anchor":1576,"definition":2894},"Internal model store","Repository inside the isolated environment from which approved model artifacts are served or deployed.",{"term":2896,"anchor":1580,"definition":2897},"Air-gap readiness","Demonstrated ability of the complete AI stack to install, start, operate, update and recover without unapproved external connectivity.",{},{"id":1584,"data":2900,"type":42,"tunes":2902},{"text":2901,"level":253},"Conclusion",{},{"id":1589,"data":2904,"type":218,"tunes":2906},{"text":2905},"Air-gapped AI is not a special kind of model. It is an AI architecture operating inside a deliberately isolated security domain.",{},{"id":1594,"data":2908,"type":218,"tunes":2910},{"text":2909},"The model can be the easy part. Production readiness depends on whether every surrounding dependency — model assets, packages, registries, identity, RAG, tools, monitoring, updates and recovery — can function without an automated external path.",{},{"id":1599,"data":2912,"type":218,"tunes":2914},{"text":2913},"The shortest reliable rule is: local inference proves where the model runs; air-gap evidence proves how the complete system is separated and how every permitted transfer crosses that boundary.",{},{"id":1604,"data":2916,"type":42,"tunes":2918},{"text":2917,"level":253},"Primary sources and current implementation references",{},{"id":1609,"data":2920,"type":218,"tunes":2922},{"text":2921},"The sources below establish the security definition, current disconnected AI deployment patterns and lifecycle risks. Vendor use of “air-gapped” is intentionally distinguished from the stricter NIST definition.",{},{"id":1614,"data":2924,"type":1621,"tunes":2928},{"link":1616,"meta":2925},{"image":2926,"title":1619,"description":2927},{"url":419},"NIST glossary definition: physically disconnected systems with non-automated, manually controlled logical transfer across the boundary.",{},{"id":1624,"data":2930,"type":1621,"tunes":2935},{"link":1626,"meta":2931},{"image":2932,"title":2933,"description":2934},{"url":419},"NVIDIA NIM — Air-Gap Deployment","Current operational guidance for staging model assets on a connected system and running NIM from local storage without internet, public registries or cloud API keys.",{},{"id":1633,"data":2937,"type":1621,"tunes":2942},{"link":1635,"meta":2938},{"image":2939,"title":2940,"description":2941},{"url":419},"Red Hat AI Inference — Disconnected deployment","Current Red Hat guidance for serving LLMs in disconnected environments with mirrored artifacts and internal infrastructure.",{},{"id":1642,"data":2944,"type":1621,"tunes":2949},{"link":1644,"meta":2945},{"image":2946,"title":2947,"description":2948},{"url":419},"Red Hat AI Inference — Storing models in disconnected environments","Current guidance covering OCI model images, persistent model storage and limitations of models requiring remote code.",{},{"id":1651,"data":2951,"type":1621,"tunes":2956},{"link":1653,"meta":2952},{"image":2953,"title":2954,"description":2955},{"url":419},"NSA — Technical Cyber Threat Framework","Threat framework explicitly identifying removable-media replication as a path into disconnected or air-gapped networks.",{},{"id":1660,"data":2958,"type":1621,"tunes":2963},{"link":1662,"meta":2959},{"image":2960,"title":2961,"description":2962},{"url":419},"NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization","Guidance for managing and sanitizing storage media according to information confidentiality requirements.",{},{"id":1669,"data":2965,"type":1621,"tunes":2970},{"link":1671,"meta":2966},{"image":2967,"title":2968,"description":2969},{"url":419},"NIST SP 800-40 Rev. 4 — Enterprise Patch Management Planning","Guidance framing patching and updates as preventive maintenance across enterprise systems.",{},{"id":1678,"data":2972,"type":1621,"tunes":2977},{"link":1680,"meta":2973},{"image":2974,"title":2975,"description":2976},{"url":419},"NIST — Software Security in Supply Chains","NIST guidance covering software supply-chain risk, provenance, verification, SBOM-related practices and vulnerability management.",{},"2.31.6","Air-gapped AI runs models, RAG and AI applications inside an isolated security domain without internet or cloud dependencies. Learn how models, data, updates and tools operate offline.",{"lang":7,"title":208,"content":210,"contentJson":2981,"excerpt":1687},{"time":212,"blocks":2982,"version":1686},[2983,2986,2989,2992,2995,2998,3001,3004,3007,3010,3013,3016,3019,3022,3025,3028,3040,3043,3046,3049,3052,3055,3067,3070,3073,3076,3093,3096,3099,3114,3117,3120,3123,3126,3129,3132,3135,3138,3141,3144,3147,3150,3153,3156,3159,3174,3177,3180,3183,3186,3189,3192,3195,3198,3201,3204,3207,3210,3213,3216,3219,3222,3225,3228,3231,3234,3237,3240,3243,3246,3249,3252,3255,3258,3261,3264,3267,3270,3273,3276,3279,3291,3294,3297,3300,3303,3306,3309,3312,3315,3318,3321,3324,3327,3330,3333,3348,3351,3354,3357,3360,3363,3380,3383,3386,3389,3392,3395,3412,3415,3418,3421,3424,3427,3430,3433,3436,3439,3442,3445,3448,3451,3462,3465,3476,3479,3482,3485,3501,3504,3525,3528,3545,3548,3563,3566,3569,3572,3575,3578,3581,3584,3587,3590,3593,3596,3599,3602,3605,3608,3611,3625,3628,3644,3647,3650,3653,3656,3659,3662,3667,3672,3677,3682,3687,3692,3697],{"id":215,"data":2984,"type":218,"tunes":2985},{"text":217},{},{"id":221,"data":2987,"type":226,"tunes":2988},{"body":223,"title":224,"variant":225},{},{"id":229,"data":2990,"type":226,"tunes":2991},{"body":231,"title":232,"variant":233},{},{"id":236,"data":2993,"type":226,"tunes":2994},{"body":238,"title":239,"variant":233},{},{"id":242,"data":2996,"type":226,"tunes":2997},{"body":244,"title":245,"variant":246},{},{"id":249,"data":2999,"type":254,"tunes":3000},{"title":251,"maxLevel":252,"minLevel":253},{},{"id":257,"data":3002,"type":42,"tunes":3003},{"text":259,"level":253},{},{"id":262,"data":3005,"type":218,"tunes":3006},{"text":264},{},{"id":267,"data":3008,"type":218,"tunes":3009},{"text":269},{},{"id":272,"data":3011,"type":218,"tunes":3012},{"text":274},{},{"id":277,"data":3014,"type":42,"tunes":3015},{"text":279,"level":253},{},{"id":282,"data":3017,"type":218,"tunes":3018},{"text":284},{},{"id":287,"data":3020,"type":218,"tunes":3021},{"text":289},{},{"id":292,"data":3023,"type":218,"tunes":3024},{"text":294},{},{"id":297,"data":3026,"type":218,"tunes":3027},{"text":299},{},{"id":302,"data":3029,"type":331,"tunes":3039},{"steps":3030,"title":329,"orientation":330},[3031,3032,3033,3034,3035,3036,3037,3038],{"label":306,"description":307},{"label":309,"description":310},{"label":312,"description":313},{"label":315,"description":316},{"label":318,"description":319},{"label":321,"description":322},{"label":324,"description":325},{"label":327,"description":328},{},{"id":334,"data":3041,"type":42,"tunes":3042},{"text":336,"level":253},{},{"id":339,"data":3044,"type":218,"tunes":3045},{"text":341},{},{"id":344,"data":3047,"type":218,"tunes":3048},{"text":346},{},{"id":349,"data":3050,"type":218,"tunes":3051},{"text":351},{},{"id":354,"data":3053,"type":42,"tunes":3054},{"text":356,"level":253},{},{"id":359,"data":3056,"type":394,"tunes":3066},{"content":3057,"stretched":43,"withHeadings":14},[3058,3059,3060,3061,3062,3063,3064,3065],[363,364,365],[367,368,369],[371,372,373],[375,376,377],[379,380,381],[383,384,385],[387,388,389],[391,392,393],{},{"id":397,"data":3068,"type":218,"tunes":3069},{"text":399},{},{"id":402,"data":3071,"type":218,"tunes":3072},{"text":404},{},{"id":407,"data":3074,"type":42,"tunes":3075},{"text":409,"level":253},{},{"id":412,"data":3077,"type":444,"tunes":3092},{"rows":3078,"title":436,"layout":394,"columns":3089},[3079,3081,3083,3085,3087],{"id":416,"label":417,"values":3080},[419,419],{"id":421,"label":422,"values":3082},[419,419],{"id":425,"label":426,"values":3084},[419,419],{"id":429,"label":430,"values":3086},[419,419],{"id":433,"label":434,"values":3088},[419,419],[3090,3091],{"id":439,"label":440},{"id":442,"label":443},{},{"id":447,"data":3094,"type":226,"tunes":3095},{"body":449,"title":450,"variant":451},{},{"id":454,"data":3097,"type":42,"tunes":3098},{"text":456,"level":253},{},{"id":459,"data":3100,"type":394,"tunes":3113},{"content":3101,"stretched":43,"withHeadings":14},[3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112],[463,464],[466,467],[469,470],[472,473],[475,476],[478,479],[481,482],[484,485],[487,488],[490,491],[493,494],{},{"id":497,"data":3115,"type":218,"tunes":3116},{"text":499},{},{"id":502,"data":3118,"type":218,"tunes":3119},{"text":504},{},{"id":507,"data":3121,"type":42,"tunes":3122},{"text":509,"level":253},{},{"id":512,"data":3124,"type":218,"tunes":3125},{"text":514},{},{"id":517,"data":3127,"type":218,"tunes":3128},{"text":519},{},{"id":522,"data":3130,"type":218,"tunes":3131},{"text":524},{},{"id":527,"data":3133,"type":42,"tunes":3134},{"text":529,"level":253},{},{"id":532,"data":3136,"type":218,"tunes":3137},{"text":534},{},{"id":537,"data":3139,"type":218,"tunes":3140},{"text":539},{},{"id":542,"data":3142,"type":218,"tunes":3143},{"text":544},{},{"id":547,"data":3145,"type":42,"tunes":3146},{"text":549,"level":253},{},{"id":552,"data":3148,"type":218,"tunes":3149},{"text":554},{},{"id":557,"data":3151,"type":218,"tunes":3152},{"text":559},{},{"id":562,"data":3154,"type":218,"tunes":3155},{"text":564},{},{"id":567,"data":3157,"type":42,"tunes":3158},{"text":569,"level":253},{},{"id":572,"data":3160,"type":394,"tunes":3173},{"content":3161,"stretched":43,"withHeadings":14},[3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172],[576,577],[579,580],[582,583],[585,586],[588,589],[591,592],[594,595],[597,598],[600,601],[603,604],[606,607],{},{"id":610,"data":3175,"type":42,"tunes":3176},{"text":612,"level":253},{},{"id":615,"data":3178,"type":218,"tunes":3179},{"text":617},{},{"id":620,"data":3181,"type":218,"tunes":3182},{"text":622},{},{"id":625,"data":3184,"type":218,"tunes":3185},{"text":627},{},{"id":630,"data":3187,"type":42,"tunes":3188},{"text":632,"level":253},{},{"id":635,"data":3190,"type":218,"tunes":3191},{"text":637},{},{"id":640,"data":3193,"type":218,"tunes":3194},{"text":642},{},{"id":645,"data":3196,"type":218,"tunes":3197},{"text":647},{},{"id":650,"data":3199,"type":218,"tunes":3200},{"text":652},{},{"id":655,"data":3202,"type":661,"tunes":3203},{"url":657,"title":658,"excerpt":659,"ctaLabel":660},{},{"id":664,"data":3205,"type":42,"tunes":3206},{"text":666,"level":253},{},{"id":669,"data":3208,"type":218,"tunes":3209},{"text":671},{},{"id":674,"data":3211,"type":218,"tunes":3212},{"text":676},{},{"id":679,"data":3214,"type":218,"tunes":3215},{"text":681},{},{"id":684,"data":3217,"type":42,"tunes":3218},{"text":686,"level":253},{},{"id":689,"data":3220,"type":218,"tunes":3221},{"text":691},{},{"id":694,"data":3223,"type":218,"tunes":3224},{"text":696},{},{"id":699,"data":3226,"type":218,"tunes":3227},{"text":701},{},{"id":704,"data":3229,"type":42,"tunes":3230},{"text":706,"level":253},{},{"id":709,"data":3232,"type":218,"tunes":3233},{"text":711},{},{"id":714,"data":3235,"type":218,"tunes":3236},{"text":716},{},{"id":719,"data":3238,"type":218,"tunes":3239},{"text":721},{},{"id":724,"data":3241,"type":42,"tunes":3242},{"text":726,"level":253},{},{"id":729,"data":3244,"type":218,"tunes":3245},{"text":731},{},{"id":734,"data":3247,"type":218,"tunes":3248},{"text":736},{},{"id":739,"data":3250,"type":218,"tunes":3251},{"text":741},{},{"id":744,"data":3253,"type":42,"tunes":3254},{"text":746,"level":253},{},{"id":749,"data":3256,"type":218,"tunes":3257},{"text":751},{},{"id":754,"data":3259,"type":218,"tunes":3260},{"text":756},{},{"id":759,"data":3262,"type":218,"tunes":3263},{"text":761},{},{"id":764,"data":3265,"type":42,"tunes":3266},{"text":766,"level":253},{},{"id":769,"data":3268,"type":218,"tunes":3269},{"text":771},{},{"id":774,"data":3271,"type":218,"tunes":3272},{"text":776},{},{"id":779,"data":3274,"type":218,"tunes":3275},{"text":781},{},{"id":784,"data":3277,"type":42,"tunes":3278},{"text":786,"level":253},{},{"id":789,"data":3280,"type":331,"tunes":3290},{"steps":3281,"title":816,"orientation":330},[3282,3283,3284,3285,3286,3287,3288,3289],{"label":793,"description":794},{"label":796,"description":797},{"label":799,"description":800},{"label":802,"description":803},{"label":805,"description":806},{"label":808,"description":809},{"label":811,"description":812},{"label":814,"description":815},{},{"id":819,"data":3292,"type":42,"tunes":3293},{"text":821,"level":253},{},{"id":824,"data":3295,"type":218,"tunes":3296},{"text":826},{},{"id":829,"data":3298,"type":218,"tunes":3299},{"text":831},{},{"id":834,"data":3301,"type":218,"tunes":3302},{"text":836},{},{"id":839,"data":3304,"type":42,"tunes":3305},{"text":841,"level":253},{},{"id":844,"data":3307,"type":218,"tunes":3308},{"text":846},{},{"id":849,"data":3310,"type":218,"tunes":3311},{"text":851},{},{"id":854,"data":3313,"type":218,"tunes":3314},{"text":856},{},{"id":859,"data":3316,"type":42,"tunes":3317},{"text":861,"level":253},{},{"id":864,"data":3319,"type":218,"tunes":3320},{"text":866},{},{"id":869,"data":3322,"type":218,"tunes":3323},{"text":871},{},{"id":874,"data":3325,"type":218,"tunes":3326},{"text":876},{},{"id":879,"data":3328,"type":42,"tunes":3329},{"text":881,"level":253},{},{"id":884,"data":3331,"type":226,"tunes":3332},{"body":886,"title":887,"variant":246},{},{"id":890,"data":3334,"type":394,"tunes":3347},{"content":3335,"stretched":43,"withHeadings":14},[3336,3337,3338,3339,3340,3341,3342,3343,3344,3345,3346],[894,895],[897,898],[900,901],[903,904],[906,907],[909,910],[912,913],[915,916],[918,919],[921,922],[924,925],{},{"id":928,"data":3349,"type":42,"tunes":3350},{"text":930,"level":253},{},{"id":933,"data":3352,"type":218,"tunes":3353},{"text":935},{},{"id":938,"data":3355,"type":218,"tunes":3356},{"text":940},{},{"id":943,"data":3358,"type":218,"tunes":3359},{"text":945},{},{"id":948,"data":3361,"type":42,"tunes":3362},{"text":950,"level":253},{},{"id":953,"data":3364,"type":394,"tunes":3379},{"content":3365,"stretched":43,"withHeadings":14},[3366,3367,3368,3369,3370,3371,3372,3373,3374,3375,3376,3377,3378],[957,958],[960,961],[963,964],[966,967],[969,970],[972,973],[975,976],[978,979],[981,982],[984,985],[987,988],[990,991],[993,994],{},{"id":997,"data":3381,"type":42,"tunes":3382},{"text":999,"level":253},{},{"id":1002,"data":3384,"type":218,"tunes":3385},{"text":1004},{},{"id":1007,"data":3387,"type":218,"tunes":3388},{"text":1009},{},{"id":1012,"data":3390,"type":218,"tunes":3391},{"text":1014},{},{"id":1017,"data":3393,"type":42,"tunes":3394},{"text":1019,"level":253},{},{"id":1022,"data":3396,"type":394,"tunes":3411},{"content":3397,"stretched":43,"withHeadings":14},[3398,3399,3400,3401,3402,3403,3404,3405,3406,3407,3408,3409,3410],[1026,1027],[1029,1030],[1032,1033],[1035,1036],[1038,1039],[1041,1042],[1044,1045],[1047,1048],[1050,1051],[1053,1054],[1056,1057],[1059,1060],[1062,1063],{},{"id":1066,"data":3413,"type":42,"tunes":3414},{"text":1068,"level":253},{},{"id":1071,"data":3416,"type":218,"tunes":3417},{"text":1073},{},{"id":1076,"data":3419,"type":218,"tunes":3420},{"text":1078},{},{"id":1081,"data":3422,"type":218,"tunes":3423},{"text":1083},{},{"id":1086,"data":3425,"type":42,"tunes":3426},{"text":1088,"level":253},{},{"id":1091,"data":3428,"type":218,"tunes":3429},{"text":1093},{},{"id":1096,"data":3431,"type":218,"tunes":3432},{"text":1098},{},{"id":1101,"data":3434,"type":218,"tunes":3435},{"text":1103},{},{"id":1106,"data":3437,"type":42,"tunes":3438},{"text":1108,"level":253},{},{"id":1111,"data":3440,"type":226,"tunes":3441},{"body":1113,"title":1114,"variant":246},{},{"id":1117,"data":3443,"type":218,"tunes":3444},{"text":1119},{},{"id":1122,"data":3446,"type":218,"tunes":3447},{"text":1124},{},{"id":1127,"data":3449,"type":218,"tunes":3450},{"text":1129},{},{"id":1132,"data":3452,"type":394,"tunes":3461},{"content":3453,"stretched":43,"withHeadings":14},[3454,3455,3456,3457,3458,3459,3460],[1136,1137],[1139,1140],[1142,1143],[1145,1146],[1148,1149],[1151,1152],[1154,1155],{},{"id":1158,"data":3463,"type":42,"tunes":3464},{"text":1160,"level":253},{},{"id":1163,"data":3466,"type":394,"tunes":3475},{"content":3467,"stretched":43,"withHeadings":14},[3468,3469,3470,3471,3472,3473,3474],[1167,1168],[1170,1171],[1173,1174],[1176,1177],[1179,1180],[1182,1183],[1185,1186],{},{"id":1189,"data":3477,"type":218,"tunes":3478},{"text":1191},{},{"id":1194,"data":3480,"type":218,"tunes":3481},{"text":1196},{},{"id":1199,"data":3483,"type":42,"tunes":3484},{"text":1201,"level":253},{},{"id":1204,"data":3486,"type":331,"tunes":3500},{"steps":3487,"title":1243,"orientation":330},[3488,3489,3490,3491,3492,3493,3494,3495,3496,3497,3498,3499],{"label":1208,"description":1209},{"label":1211,"description":1212},{"label":1214,"description":1215},{"label":1217,"description":1218},{"label":1220,"description":1221},{"label":1223,"description":1224},{"label":1226,"description":1227},{"label":1229,"description":1230},{"label":1232,"description":1233},{"label":1235,"description":1236},{"label":1238,"description":1239},{"label":1241,"description":1242},{},{"id":1246,"data":3502,"type":42,"tunes":3503},{"text":1248,"level":253},{},{"id":1251,"data":3505,"type":394,"tunes":3524},{"content":3506,"stretched":43,"withHeadings":14},[3507,3508,3509,3510,3511,3512,3513,3514,3515,3516,3517,3518,3519,3520,3521,3522,3523],[1255,1256],[1258,1259],[1261,1262],[1264,1265],[1267,1268],[1270,1271],[1273,1274],[1276,1277],[1279,1280],[1282,1283],[1285,1286],[1288,1289],[1291,1292],[1294,1295],[1297,1298],[1300,1301],[1303,1304],{},{"id":1307,"data":3526,"type":42,"tunes":3527},{"text":1309,"level":253},{},{"id":1312,"data":3529,"type":394,"tunes":3544},{"content":3530,"stretched":43,"withHeadings":14},[3531,3532,3533,3534,3535,3536,3537,3538,3539,3540,3541,3542,3543],[1316,1317],[1319,1320],[1322,1323],[1325,1326],[1328,1329],[1331,1332],[1334,1335],[1337,1338],[1340,1341],[1343,1344],[1346,1347],[1349,1350],[1352,1353],{},{"id":1356,"data":3546,"type":42,"tunes":3547},{"text":1358,"level":253},{},{"id":1361,"data":3549,"type":394,"tunes":3562},{"content":3550,"stretched":43,"withHeadings":14},[3551,3552,3553,3554,3555,3556,3557,3558,3559,3560,3561],[1365,1366],[1368,1369],[1371,1372],[1374,1375],[1377,1378],[1380,1381],[1383,1384],[1386,1387],[1389,1390],[1392,1393],[1395,1396],{},{"id":1399,"data":3564,"type":42,"tunes":3565},{"text":1401,"level":253},{},{"id":1404,"data":3567,"type":218,"tunes":3568},{"text":1406},{},{"id":1409,"data":3570,"type":218,"tunes":3571},{"text":1411},{},{"id":1414,"data":3573,"type":218,"tunes":3574},{"text":1416},{},{"id":1419,"data":3576,"type":218,"tunes":3577},{"text":1421},{},{"id":1424,"data":3579,"type":218,"tunes":3580},{"text":1426},{},{"id":1429,"data":3582,"type":42,"tunes":3583},{"text":1431,"level":253},{},{"id":1434,"data":3585,"type":218,"tunes":3586},{"text":1436},{},{"id":1439,"data":3588,"type":218,"tunes":3589},{"text":1441},{},{"id":1444,"data":3591,"type":218,"tunes":3592},{"text":1446},{},{"id":1449,"data":3594,"type":42,"tunes":3595},{"text":1451,"level":253},{},{"id":1454,"data":3597,"type":218,"tunes":3598},{"text":1456},{},{"id":1459,"data":3600,"type":218,"tunes":3601},{"text":1461},{},{"id":1464,"data":3603,"type":218,"tunes":3604},{"text":1466},{},{"id":1469,"data":3606,"type":661,"tunes":3607},{"url":1471,"title":1472,"excerpt":1473,"ctaLabel":1474},{},{"id":1477,"data":3609,"type":42,"tunes":3610},{"text":1479,"level":253},{},{"id":1482,"data":3612,"type":1482,"tunes":3624},{"items":3613,"title":1525},[3614,3615,3616,3617,3618,3619,3620,3621,3622,3623],{"id":1486,"answer":1487,"question":1488},{"id":1490,"answer":1491,"question":1492},{"id":1494,"answer":1495,"question":1496},{"id":1498,"answer":1499,"question":1500},{"id":1502,"answer":1503,"question":1504},{"id":1506,"answer":1507,"question":1508},{"id":1510,"answer":1511,"question":1512},{"id":1514,"answer":1515,"question":1516},{"id":1518,"answer":1519,"question":1520},{"id":1522,"answer":1523,"question":1524},{},{"id":1528,"data":3626,"type":42,"tunes":3627},{"text":1530,"level":253},{},{"id":1533,"data":3629,"type":1533,"tunes":3643},{"title":1535,"entries":3630},[3631,3632,3633,3634,3635,3636,3637,3638,3639,3640,3641,3642],{"term":1538,"anchor":1539,"definition":1540},{"term":1542,"anchor":1543,"definition":1544},{"term":375,"anchor":1546,"definition":1547},{"term":371,"anchor":1549,"definition":1550},{"term":367,"anchor":1552,"definition":1553},{"term":1555,"anchor":1556,"definition":1557},{"term":1559,"anchor":1560,"definition":1561},{"term":1563,"anchor":1564,"definition":1565},{"term":1567,"anchor":1568,"definition":1569},{"term":1571,"anchor":1572,"definition":1573},{"term":1575,"anchor":1576,"definition":1577},{"term":1579,"anchor":1580,"definition":1581},{},{"id":1584,"data":3645,"type":42,"tunes":3646},{"text":1586,"level":253},{},{"id":1589,"data":3648,"type":218,"tunes":3649},{"text":1591},{},{"id":1594,"data":3651,"type":218,"tunes":3652},{"text":1596},{},{"id":1599,"data":3654,"type":218,"tunes":3655},{"text":1601},{},{"id":1604,"data":3657,"type":42,"tunes":3658},{"text":1606,"level":253},{},{"id":1609,"data":3660,"type":218,"tunes":3661},{"text":1611},{},{"id":1614,"data":3663,"type":1621,"tunes":3666},{"link":1616,"meta":3664},{"image":3665,"title":1619,"description":1620},{"url":419},{},{"id":1624,"data":3668,"type":1621,"tunes":3671},{"link":1626,"meta":3669},{"image":3670,"title":1629,"description":1630},{"url":419},{},{"id":1633,"data":3673,"type":1621,"tunes":3676},{"link":1635,"meta":3674},{"image":3675,"title":1638,"description":1639},{"url":419},{},{"id":1642,"data":3678,"type":1621,"tunes":3681},{"link":1644,"meta":3679},{"image":3680,"title":1647,"description":1648},{"url":419},{},{"id":1651,"data":3683,"type":1621,"tunes":3686},{"link":1653,"meta":3684},{"image":3685,"title":1656,"description":1657},{"url":419},{},{"id":1660,"data":3688,"type":1621,"tunes":3691},{"link":1662,"meta":3689},{"image":3690,"title":1665,"description":1666},{"url":419},{},{"id":1669,"data":3693,"type":1621,"tunes":3696},{"link":1671,"meta":3694},{"image":3695,"title":1674,"description":1675},{"url":419},{},{"id":1678,"data":3698,"type":1621,"tunes":3701},{"link":1680,"meta":3699},{"image":3700,"title":1683,"description":1684},{"url":419},{},"Post erfolgreich abgerufen",{"items":3704,"source":3788,"manualIds":3789,"manualMatchedIds":3790},[3705,3712,3719,3726,3733,3740,3747,3754,3760,3767,3774,3781],{"id":3706,"slug":3707,"title":3708,"excerpt":3709,"featuredImage":3710,"publishedAt":3711},"484","what-is-an-ai-platform-architect-models-data-runtime-security-and-operations","¿Qué es un arquitecto de plataforma de IA? Modelos, datos, entorno de ejecución, seguridad y operaciones","Un Arquitecto de Plataformas de IA diseña fundamentos de IA reutilizables a través de modelos, proveedores, recuperación, agentes, identidad, seguridad, evaluación, observabilidad y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-platform-architect-models-data-runtime-security-and-operations-1791477229171-ou3zcc.webp","2026-10-08T12:32:00.000Z",{"id":3713,"slug":3714,"title":3715,"excerpt":3716,"featuredImage":3717,"publishedAt":3718},"487","vector-databases-embeddings-and-reranking-three-different-parts-of-retrieval","Bases de datos vectoriales, embeddings y reranking: tres partes diferentes de la recuperación","Las incrustaciones representan el significado, las bases de datos vectoriales recuperan candidatos y los rerankers refinan los resultados. Aprende en qué se diferencian y cómo trabajan juntas estas tres capas de recuperación en RAG.","\u002Fuploads\u002F2026\u002F10\u002Fvector-databases-embeddings-and-reranking-three-different-parts-of-retrieval-1791480129884-9dtasz.webp","2026-10-08T11:21:00.000Z",{"id":3720,"slug":3721,"title":3722,"excerpt":3723,"featuredImage":3724,"publishedAt":3725},"476","mcp-vs-a2a-vs-ucp-vs-ap2-vs-a2ui-the-agent-protocol-stack-explained","MCP vs A2A vs UCP vs AP2 vs A2UI: La pila de protocolos de agentes explicada","MCP, A2A, UCP, AP2 y A2UI a menudo se presentan como estándares de agentes competidores. En su mayoría, resuelven diferentes problemas de interoperabilidad. Esta guía mapea cada protocolo con el límite que realmente estandariza—y muestra cómo pueden funcionar juntos en un sistema de producción.","\u002Fuploads\u002F2026\u002F09\u002Fmcp-vs-a2a-vs-ucp-vs-ap2-vs-a2ui-the-agent-protocol-stack-explained-1790352625869-2ezle0.webp","2026-09-25T12:09:00.000Z",{"id":3727,"slug":3728,"title":3729,"excerpt":3730,"featuredImage":3731,"publishedAt":3732},"490","rbac-vs-tenant-isolation-two-different-security-boundaries","RBAC vs Aislamiento de Inquilinos: Dos Límites de Seguridad Diferentes","El RBAC controla lo que un usuario puede hacer; el aislamiento de inquilinos controla a qué recursos de qué inquilino puede llegar esa acción. Descubre por qué la seguridad SaaS multiinquilino requiere ambos límites.","\u002Fuploads\u002F2026\u002F10\u002Frbac-vs-tenant-isolation-two-different-security-boundaries-1791485111528-qqtzby.webp","2026-10-08T14:43:00.000Z",{"id":3734,"slug":3735,"title":3736,"excerpt":3737,"featuredImage":3738,"publishedAt":3739},"470","what-should-an-ai-agent-remember-forget-recompute-or-retrieve-again","¿Qué debería recordar, olvidar, recalcular o volver a recuperar un agente de IA?","Los agentes de larga duración no deberían recordarlo todo. Este artículo proporciona un modelo práctico de ciclo de vida para decidir qué pertenece a la memoria duradera, qué se debería recuperar de nuevo, qué es más seguro recalcular y qué debería expirar o ser sustituido.","\u002Fuploads\u002F2026\u002F09\u002Fwhat-should-an-ai-agent-remember-forget-recompute-or-retrieve-again-1790351131087-iehz28.webp","2026-09-25T09:43:00.000Z",{"id":3741,"slug":3742,"title":3743,"excerpt":3744,"featuredImage":3745,"publishedAt":3746},"492","mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","MCP explicado: qué conecta, qué no hace y dónde encaja","El Protocolo de Contexto de Modelo conecta aplicaciones de IA con herramientas, recursos y prompts externos a través de un límite estándar cliente-servidor. Aprende qué hace MCP, qué no hace y dónde encaja en la arquitectura de agentes.","\u002Fuploads\u002F2026\u002F10\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits-1791486640275-7ub1cq.webp","2026-10-08T15:09:00.000Z",{"id":3748,"slug":3749,"title":3750,"excerpt":3751,"featuredImage":3752,"publishedAt":3753},"483","what-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs","¿Qué es un arquitecto de soluciones de IA? Límites del sistema, responsabilidades y compensaciones","Un Arquitecto de Soluciones de IA convierte los requisitos empresariales en un sistema de IA listo para producción que abarca datos, modelos, herramientas, seguridad, tiempo de ejecución, evaluación y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs-1791476643267-1st5xz.webp","2026-10-08T12:23:00.000Z",{"id":3755,"slug":3756,"title":1472,"excerpt":3757,"featuredImage":3758,"publishedAt":3759},"468","ai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","La memoria del agente, RAG, el estado y el contexto a menudo se usan como si fueran intercambiables. No lo son. Este modelo práctico de arquitectura separa las cuatro capas, muestra dónde pertenece cada una y explica qué se rompe cuando los sistemas las colapsan en una sola.","\u002Fuploads\u002F2026\u002F09\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context-1790350560308-np0xy6.webp","2026-09-25T11:34:00.000Z",{"id":3761,"slug":3762,"title":3763,"excerpt":3764,"featuredImage":3765,"publishedAt":3766},"478","what-is-rag-the-simplest-explanation-of-how-it-works","¿Qué es RAG? La explicación más sencilla de cómo funciona","RAG suena complicado, pero la idea es simple: antes de que una IA responda, primero busca información útil de una fuente de conocimiento y le da esa información al modelo de lenguaje. Esta guía explica RAG, los LLM, el estado, la memoria y las herramientas usando un modelo mental simple.","\u002Fuploads\u002F2026\u002F09\u002Fwhat-is-rag-the-simplest-explanation-of-how-it-works-1790377492124-khjagt.webp","2026-09-25T19:03:00.000Z",{"id":3768,"slug":3769,"title":3770,"excerpt":3771,"featuredImage":3772,"publishedAt":3773},"479","where-does-an-llm-get-its-data-rag-data-sources-in-python","¿De dónde obtiene sus datos un LLM? Fuentes de datos RAG en Python","Un LLM no conoce mágicamente tus archivos, bases de datos o APIs. Esta continuación práctica de la serie RAG muestra, con Python sencillo, cómo los datos externos se convierten en evidencia recuperable: desde archivos de texto y SQL hasta búsqueda de texto completo, embeddings, ensamblaje de contexto y la llamada final al LLM.","\u002Fuploads\u002F2026\u002F09\u002Fwhere-does-an-llm-get-its-data-rag-data-sources-in-python-1790517200521-nfsi5i.webp","2026-09-27T05:51:00.000Z",{"id":3775,"slug":3776,"title":3777,"excerpt":3778,"featuredImage":3779,"publishedAt":3780},"485","enterprise-ai-architecture-what-changes-when-ai-enters-a-company","Arquitectura de IA empresarial: qué cambia cuando la IA entra en una empresa","La arquitectura de IA empresarial explica cómo la IA cambia los sistemas de la empresa en materia de autoridad sobre los datos, identidad, permisos, proveedores, riesgo, gobernanza, evaluación, cumplimiento y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fenterprise-ai-architecture-what-changes-when-ai-enters-a-company-1791478161363-czrwaq.webp","2026-10-08T10:48:00.000Z",{"id":3782,"slug":3783,"title":3784,"excerpt":3785,"featuredImage":3786,"publishedAt":3787},"481","generative-ai-explained-models-retrieval-tools-and-applications-are-not-the-same-thing","IA generativa explicada: modelos, recuperación, herramientas y aplicaciones no son lo mismo","La IA generativa es más que un modelo. Aprende cómo los modelos, la recuperación, las herramientas, el contexto, los entornos de ejecución y las aplicaciones encajan en los sistemas de IA en producción.","\u002Fuploads\u002F2026\u002F10\u002Fgenerative-ai-explained-models-retrieval-tools-and-applications-are-not-the-same-thing-1791475411822-pp0dvz.webp","2026-10-08T12:00:00.000Z","fallback",[],[]]