The architecture of governed private AI

"Private AI" usually gets explained with a diagram of a model in a box. The interesting engineering is everything around the box: how knowledge gets in, how answers get out, how the system improves without leaking, and how any of it can be proven later. This is the architecture Locs uses, layer by layer.

The shape: an appliance, not a service

Locs ships as a hardened container package installed on the customer's infrastructure — from a laptop-class host for pilots to Kubernetes for enterprise rollout, including fully air-gapped sites. There is no vendor cloud, no account, no telemetry. The web portal, API, model runtime, vector stores, and audit chain all live inside the customer boundary.

The governed knowledge lifecycle

Every piece of knowledge moves through the same controlled path:

1. Ingest — documents arrive from read-only sources (SOP repositories, ticket exports, uploads).
2. Classify — deterministic detectors find secrets and sensitive identifiers; critical secrets block the document entirely.
3. Redact — identifiers are masked; only redacted text is ever chunked or embedded.
4. Package — content becomes a versioned knowledge pack carrying provenance, permissions, risk level, and a rollback ID.
5. Approve — a two-key workflow activates the pack; security-flagged content takes a dedicated review path.
6. Serve — retrieval is partitioned by module and filtered by role at query time; answers carry citations, confidence, and risk labels under a fail-closed policy.
7. Improve — gaps become sanitized outbound requests; intelligence returns as signed offline bundles that must pass five gates before activation.
8. Reverse — any activation can be rolled back, reactivating its predecessor with a full impact analysis.

The model layer is deliberately boring

An adapter abstracts the model runtime — open-weight families like Llama, Mistral, or Qwen served locally, or an enterprise-provided endpoint — so the governance layer never depends on a model vendor. Embeddings run locally too. The architecture treats models as replaceable components and governance as the product.

Trust is a runtime property

Governance that only exists at configuration time drifts. Locs implements the AOS-1 runtime contract: a kill switch checked before every consequence-bearing action, lineage identifiers on material decisions, deterministic admissibility verdicts on outbound actions, and signed execution receipts — all feeding a hash-chained audit log whose integrity is verifiable in one call.

Vector search answers "what does the AI know?" The audit chain answers the harder question: "who let it know that, and can we undo it?"

Scaling path

The pilot appliance and the enterprise deployment are the same software: database and vector store swap via configuration, the portal is stateless, and the evidence layer is identical from day one — which is what lets a 90-day pilot's audit trail carry forward as the production system's history.