A workforce of people and agents needs more than a model. It needs a place to work, boundaries to respect and a reliable way to ask for help.
Design guidance for project scoping. Capabilities, products and delivery plans are confirmed through enquiry.
01Local knowledgeAuthorised sources & retrieval
→
02Local inferenceTask model & scoped tools
→
03Policy gatewayClassify · minimise · approve
→
04Optional cloudApproved model & region
→
05Validated resultCheck · log · human review
01 / PLACE THE WORK
Keep knowledge near its owner.
Start with a defined workflow: who asks, what information is needed and what a useful result looks like. A local model can process selected tasks near a branch, office or private compute environment. An access-controlled retrieval layer can supply approved reference material without granting the agent broad access to every document.
“Local” needs an end-to-end definition. Check embeddings, telemetry, logs, backups, support access and recovery copies alongside inference. A local model alone does not establish where all data travels. Separate tenants and business units, encrypt storage and record which identity can retrieve each source.
Measure latency, throughput and output quality against real examples before choosing hardware. Maintain a fallback for unavailable models and a manual path for work the system cannot complete safely.
02 / CONNECT THE ESTATE
One policy, appropriate boundaries.
Use identity and network segmentation to connect authorised locations without making every site part of one unrestricted trust zone. Separate user devices, management interfaces, model hosts, retrieval stores and agent tools. Specify which traffic may cross each boundary and observe the result.
Equiinet’s published SD-WAN material describes a premises/cloud approach, traffic prioritisation and site connectivity. Those network foundations can support an AI design, but they do not determine an agent’s authority. Authentication, application permissions and approvals need their own controls.
Some tasks may benefit from an approved foundation model. Route them through a gateway that checks data classification and customer policy before sending anything. Minimise the request, remove information the task does not need and reject a route that cannot satisfy the policy.
Confirm provider terms, retention settings, processing region, identity and cost limits for the actual project. Keep service credentials on the controlled server side, away from prompts and browser code. Log the routing decision and give the operator a way to disable external processing.
Validate responses before they reach another system. Separate generating a draft from permission to send, purchase, publish or change a record. A stronger model is not a substitute for a narrower permission.
04 / LEARN WITHOUT LOSING CONTROL
Improve the system deliberately.
Capture approved feedback as a managed dataset, not an automatic stream into training. Review candidate changes, version prompts and retrieval sources, and evaluate the new configuration against a fixed set of useful and adversarial examples. Record who approved a release and how to roll it back.
Use signed or verified model artefacts where available, controlled distribution and isolated evaluation. Protect long-lived agent memory with the same source and access controls as other business records. Keep learning material, operational instructions and untrusted external content distinct.
THREE DIFFERENT PROBLEMS
Protect the context. Protect the action.
Prompt injection
Malicious instructions can arrive in a request, webpage or document and try to redirect an agent. Treat retrieved content as data; limit tools, validate outputs and require approval for privileged actions. Local deployment does not remove this risk.
An untrusted document or stored “memory” can introduce misleading evidence or instructions later. Use provenance, access checks, review queues and versioned retrieval stores. A quoted passage should never become a new system instruction.
Data & model poisoning
Changes to training or embedding data can compromise integrity. Vet sources and model suppliers, control updates and evaluate releases before production. This differs from a single hostile prompt during inference.
Unified threat management addresses network-edge risks. It does not by itself prevent all LLM attacks. Layered controls reduce risk; no complete prevention claim is made.
INTERACTIVE / A POLICY WALK-THROUGH
Should this request leave the site?
Explore a simplified design policy. This browser-only simulation makes no model calls, reads no files and performs no security scan.
Start small. Design the boundary first.
Bring one workflow, the locations involved and a clear list of what data may leave each location.