Program agents on one Czar inside the enclave

A defense or space program runs on material that may not leave the room it was made in. Requirements and the evidence that verifies them, test procedures and results, anomaly records, supplier deliverables, mission and telemetry data: each is compartmented by program and by need to know, and each is exactly the kind of material agents are good at reading, cross-referencing, and drafting from. In a cloud assistant, doing any of that means sending the material out of the enclave, which is the one thing the program may not do. One Czar inside the enclave runs the agents on the program's own material, with no path out, and nothing leaves a compartment without the person cleared to release it.

What the team is asked to do

A program office spends its days keeping a very large body of technical material consistent with itself. Every requirement has to trace to a verification method and to the evidence that the method was carried out. Every test produces a procedure, a result, and often an anomaly, and each of those produces a report that reviewers will read months later. Every supplier deliverable arrives against a statement of work and is checked against it. Every review package is assembled from all of the above.

Most of this is reading and drafting: finding the passages that bear on a question, noticing what has drifted since the last review, and writing the first version of a document from the records that support it. It is work agents do well, and it is work the program has so far had to do without them.

Why a cloud assistant fails here

Controlled technical data cannot leave the enclave to be searched, summarized, or drafted from. That is not a preference the program can trade against convenience; it is a condition of the program existing. A connected assistant is a path out, and for many enclaves a path out of any kind is something the program is not permitted to have.

The perimeter is not the only boundary. Compartments inside the program are as hard a wall as the one around it, and an assistant that reads across them, even inside the building, is a disclosure. And an agent holds no clearance. A draft that an agent wrote is a draft; a release from a compartment is a person's act, made by someone with the authority to make it, and written down.

Requirements traced to their evidence

On one Czar inside the enclave, agents in Agency Studio read the requirements, the verification matrix, the test procedures, and the results on the appliance and keep the trace between them current. Retrieval gives an agent the program's own documents, within the compartment it was authored for; Memory keeps what it has learned about the program between tasks; Inference runs an open-weight model on the appliance. The agent flags requirements that have no evidence, evidence that has changed since the requirement was last verified, and procedures that drifted from the requirement they test. The engineer decides what each flag means.

Adaptation can tune the model on the program's own documents, on the appliance, so the agent reads the program's vocabulary rather than a general one. Nothing about that tuning leaves the enclave.

Test and anomaly reports a cleared person releases

For a test report, an anomaly report, or a review package, the agent assembles the first draft from the program's own records, with the passages each paragraph came from, and holds it in a queue for the engineer with authority to release it. That person reads the draft and its sources, approves it, sends it back with notes, or rejects it. The approval, the approver, and the authority under which the release was made are written beside the draft.

That is the boundary this solution is built around. Agents prepare and propose; a person with the authority to release decides. Nothing leaves a compartment on an agent's say-so, and every step is on the record the program holds.

Compartments enforced by role

Each agent is authored for one program and one compartment, with the retrieval scopes, memory, and routes that compartment may have. Local Bridge permits those routes one by one and denies everything else. Every retrieval is written to the log with the role it was made under, so the program can answer, from its own record, who read what and on whose authority. Watchman verifies what is running on the appliance, Evaluation scores the agents' drafts against reports the program has already released, and any run can be replayed to show how a draft was reached. A program that wants a harder separation than roles can give it places one Czar per compartment.

One Czar, placed and bought

The Czar is a sealed node in the program's own rack, inside the enclave, on the segment the program chooses. In most enclaves it runs with no route out at all. Updates arrive as signed bundles the program's own staff carry in and verify on the console; the appliance never connects to Element 31, and no remote session is ever opened to it. Where a program permits connections, they are declared one by one at commissioning, to systems the program already secures, and nothing else. The team holds one subscription for the configured appliance, with the hardware, the platform license, and sustainment in one line, fixed for the term. A solution brief for a defense or space program office describes the intended architecture; it is substantiated at commissioning and makes no customer claim.

The program's constraint was never that agents are unsafe. It was that the only way to have them was to send the program's material out of the enclave and let a service act without a cleared person behind the result. One Czar inside the enclave keeps the material, keeps the compartments, keeps the record, and keeps the release in a person's hands.