Ask how an AI platform prevents data from reaching an unapproved model, and the answer is usually a feature: a policy screen, an allow-list, a guardrail. All useful, and all enforced by the same software they are meant to constrain. If a component forgets to call the policy check, or a new integration bypasses it, the control simply is not there.
When we designed AIRA Nexus we wanted a control that holds even when application code is wrong. That control is the network.
Two doors, and a wall everywhere else
AIRA Nexus has exactly two ways out:
- The model door, AIRA Gateway. Every model, embedding and re-ranking call goes through it. It holds the provider keys, applies policy, guardrails, DLP and budgets, and records spend.
- The channel door, AIRA Runtime. Every inbound trigger (Slack, email, webhooks, S3 and schedules) and every outbound delivery passes through it, with retry.
Everything else is denied by the cluster's baseline network policy, including private address ranges. That last detail matters: many breaches of "internal only" systems travel sideways across the private network, not out to the internet.
If the only road to a model runs through the Gateway, a missed policy check in some other component cannot become a data leak.
Declared, never guessed
Local models are the obvious complication. Your GPU server running Ollama, vLLM or SGLang lives on a private address, which the baseline denies. Plenty of platforms solve this by scanning for model servers or opening the private network wholesale.
We do neither. A local model server is explicit configuration, and declaring it opens exactly that one exception. The operator can see every hole in the wall, because each one was put there on purpose and written down.
What this buys you
- A small, reviewable attack surface. Your security team reviews two doors, not every component that might one day call an API.
- Keys in one place. Provider credentials live in the Gateway, never in applications or notebooks.
- Vendor independence. Applications call a governed AI Endpoint, so changing the model behind it is configuration, not a release.
- An answer to "where can our data go?" It is the list of declared exceptions: short, explicit and auditable.
Defence in depth, not instead of it
The two doors do not replace application controls; they back them up. Server-side authorization, row-level isolation in PostgreSQL, guardrails before the call and a tamper-evident audit after it still apply. The network simply ensures that when one of those layers is wrong, the failure is contained rather than silent.
