Decoupling Model Lists From Core Workflows for Air-Gapped AI Agent Deployments

Last month, my team finished deploying an air-gapped AI agent workflow for our company’s internal legal document review. We’d spent weeks locking down the core workflow design: standardized prompt templates, fixed output validation rules, and a strict audit log pipeline that signed every entry with a private key to ensure immutability. A week after launch, our legal team requested we swap out two of the three pre-approved local models in the agent’s configuration—one underperformed on contract parsing, the other had a known vulnerability we needed to patch. When I tried to update the model list in our agent setup, I noticed that the changes also altered the hash generation logic we’d used to sign audit logs, which meant the existing log immutability safeguards we’d implemented wouldn’t apply to the new model calls. I panicked at first; I didn’t want to have to redesign the entire workflow just to add new models, but I also couldn’t risk breaking the audit trail compliance our security team required.

The Pattern That Solved It: Separating Model Configuration from Workflow Logic

After digging through open-source resources for air-gapped agent setups, I landed on a pattern that separated model configuration from core workflow logic, which I first read about in documentation for FastGPT on GitHub. Instead of hardcoding model selections directly into workflow steps, we created a dedicated model registry module that stored all approved local models alongside their metadata, prompt tuning parameters, and versioned manifest. The agent would pull the current model manifest from this registry at runtime, rather than relying on hardcoded values. When we needed to update the model list, we only needed to revise the manifest, sign it with our existing audit private key, and push the updated file to the air-gapped network. This meant the core workflow code didn’t change at all—no rewrites of prompt templates or validation logic were required.

How the New Setup Preserves Audit Log Integrity

Every model call the agent makes now first validates the current manifest’s signature against our trusted public key, ensuring only approved models are used. The audit log pipeline still captures the model ID used for each call, but the hash of each log entry is generated using the original workflow parameters, user input, and final agent output—so changes to the model list have no impact on the immutability of existing or new logs. We tested this setup by running a batch of test document reviews, first with the original model list, then after updating the manifest, and confirmed that all log entries retained consistent hash validation rules, with no gaps or breaks in the audit trail.

The Critical Caveat: Securing the Model Registry Itself

There’s one key caveat to this setup. The model registry module itself needs strict access controls and immutability safeguards, since it’s the single point of control for approved models. We locked down the registry’s configuration files to only be editable by our DevOps team via air-gapped SSH sessions, and we added a secondary audit log specifically for changes to the model manifest, so any updates to the model list are themselves recorded and immutable. We also adjusted our prompt templates to pull model-specific tuning instructions from the same versioned manifest, rather than hardcoding them into the core workflow, which lets us make minor prompt adjustments for new models without touching the main workflow code.

FAQ

What is an air-gapped AI agent workflow?

An air-gapped environment is a network that is completely isolated from external networks. Deploying an AI agent workflow in such an environment means all models, data, and tools must run locally, without relying on external APIs or cloud services. This deployment model is common in legal, government, and financial scenarios where data security and regulatory compliance requirements are extremely high.

Why did swapping models affect the audit log signing logic?

In the original workflow, model selection was likely hardcoded into the core pipeline, and the hash generation logic for audit logs was tied to those workflow parameters. When models were swapped, the workflow parameters changed, which in turn altered the hash generation rules. This invalidated the immutability verification of existing logs and risked creating breaks in the audit trail.