Air-Gapped AI Code Generation: A Reference Architecture for Defense Contractors

The Constraint That Reshapes Everything

For most software teams, "send the code to a SaaS API" is invisible, it just works. For defense contractors, federal agencies, and certain critical-infrastructure operators, that single design choice eliminates 95% of AI coding tooling from consideration. Source code under ITAR controls, in environments under FedRAMP High, or running on classified networks cannot leave the perimeter. Period.

This post is the reference architecture we deploy for those customers. It assumes a fully air-gapped environment: no outbound internet traffic, no external API calls, no SaaS dependencies. Everything (model serving, pipeline orchestration, audit storage), runs inside the customer's boundary.

The Components

Five components, all customer-hosted:

• Model serving. A locally-hosted inference stack. For most defense customers, this is an on-prem GPU cluster running an enterprise-licensed model. The model weights are delivered on physical media or via cleared download channels and live entirely within the perimeter.
• Pipeline orchestrator. The multi-agent coordinator, planner, coder, reviewer, security, test, root-cause. Containerized, deployed via the customer's standard orchestration stack (typically OpenShift or air-gapped Kubernetes).
• Source integration. Connectors to on-prem GitLab, Bitbucket Server, or Azure DevOps Server. No cloud SaaS connectors.
• Audit and observability. Logs and traces ship to the customer's existing SIEM. No external telemetry endpoints.
• Update channel. A cleared, manual update process for the orchestrator and model. Typically quarterly, with each update reviewed by the customer's security team before deployment.

The full deployment fits on a 3-node cluster for small teams, scaling to 20+ nodes for the largest deployments.

What You Lose, And How To Compensate

Three things you cannot have in this architecture:

A frontier proprietary model accessed over the public internet. You are running an on-prem-eligible model. The capability gap with public frontier models is roughly 6-9 months. For ticket-to-PR workflows, that gap is not material. For research-grade reasoning, it can be.

SaaS-side observability and dashboards. You operate your own. The orchestrator emits OpenTelemetry traces and Prometheus metrics that plug into existing customer infrastructure.

Vendor-pushed updates. Quarterly cleared updates instead of weekly SaaS pushes. The compensation is operational discipline: tested, audited releases that move slower but never surprise.

The Network Architecture

The deployment sits in three zones:

• Code zone. GitLab/Bitbucket Server, the pipeline orchestrator, and the model serving. All in the same trust boundary, with mTLS between components.
• Audit zone. Long-term audit storage, SIEM integration, and the compliance reporting tier.
• Operations zone. Update staging and operator workstations.

No traffic crosses the boundary outbound. Inbound traffic is restricted to authenticated operators and code-zone clients (developer workstations or CI runners).

The Compliance Story

For FedRAMP High and DoD IL5/IL6 customers, the architecture supports:

• Boundary discipline. All data stays in-boundary. No SaaS data flows.
• Audit trails. Every AI action (plan, change, validation, decision), is logged with timestamps, agent identity, and human approval state. Audit logs are immutable and retained per the customer's retention policy.
• Identity integration. Operators authenticate through the customer's existing IdP (typically Okta or Active Directory Federation Services). No vendor-managed identity.
• Cryptographic posture. FIPS 140-2 validated cryptographic modules throughout. TLS 1.3 with approved cipher suites only.
• Vulnerability management. Quarterly CVE assessment on the deployed software stack, tied to the customer's STIG compliance process.

The Audit Trail Specifically

This is the question every accreditor asks first. The architecture produces, per AI-generated change:

• The triggering event (ticket creation, label assignment, scheduled scan).
• The planner's decomposition, with reasoning.
• The coder agent's diff and the inputs it received.
• The reviewer agent's findings and recommendations.
• The security agent's findings.
• The test agent's generated tests and results.
• The decision engine's confidence score and routing decision.
• The human approver, if any, with timestamp and IP.
• The merge event and the eventual production deployment, linked to the PR.

This is more audit detail than most human-generated changes carry. For regulated environments, this is the selling point. For details on the audit framework, see SOC 2 compliance for AI code generation.

The Performance Profile

For a 3-node cluster (modest deployment, ~50 engineers):

• Ticket parse to first plan: 8-15 seconds.
• Plan to first diff: 45-90 seconds.
• Full pipeline including validation: 3-6 minutes per ticket.
• Concurrent tickets supported: 8-12.

This is slower than a SaaS deployment with elastic capacity, but comfortably faster than the human review and merge cycle. The bottleneck is human review, not the pipeline.

What Does Not Work In This Environment

Three patterns that do not translate to air-gapped:

Vector retrieval over a SaaS-hosted embedding service. You need on-prem embeddings. The trade-off is acceptable embedding quality with smaller, cheaper-to-host embedding models.

Public-internet documentation lookups. The agent cannot Google a Stack Overflow answer. It works from the customer's internal documentation, code comments, and learned context. Onboarding documentation matters more in this environment.

Telemetry to the vendor. No outbound telemetry. The vendor cannot see what is failing. Diagnostic data is collected by customer ops and shared through cleared channels if a support case requires it.

What Surprised Us

Two things that emerged from deploying this:

The on-prem model is "good enough" sooner than expected. For ticket-to-PR work, the local model is competitive after the first month of per-repo learning calibration. The frontier model gap matters less when the task is well-scoped.

The audit trail is a productivity feature, not just compliance. Engineers who can see exactly what the AI did, why, and on what input file the issue at much faster pace. The audit detail produced for the accreditor is also the debugging information operators need.

Who Should Consider This

Three signals you are in the air-gapped tier:

• Your code is subject to export controls (ITAR, EAR).
• Your environment is FedRAMP High, DoD IL5/IL6, or classified.
• Your security team will not approve sending source to a SaaS endpoint, regardless of contract language.

If any apply, the SaaS tier is not an option for you. The air-gapped tier is. For the broader compliance scaffolding, see AI coding in regulated industries. For the self-hosted buyer's guide more broadly, see self-hosted AI coding agent buyer's guide.