FIELD NOTE 01 · SECURITY
Four security patterns for AI, and how to pick yours.
Before you choose a model, decide what each model may see. The architecture follows.
Start with what each model may see.
We use four patterns on a security dial. Each is a starting point for a deployment conversation. Model routes, hosting and controls are confirmed for each deployment and recorded in its Security Level Schedule.
LEVEL 1
Open
Public frontier models under enterprise terms, with information controls set for the deployment. This can fit work without special processing requirements. The allowed data, redaction, access rules and request records are agreed before use.
LEVEL 2
Hybrid
Sensitive work uses private models; other work may use public models by separate agreement. Routing rules decide which model may process each task. The actual routes and controls are recorded for the deployment.
LEVEL 3
Private
Private models only. Review where records are stored and where inference happens; those are separate boundaries. Hosting and isolation details are On request until the deployment truth table is signed.
LEVEL 4
Sovereign
Private models on hardware the customer controls are the intended pattern. Customer-held keys and hosting choices must be confirmed in the Security Level Schedule. Availability is On request.
A HYPOTHETICAL EXAMPLE
List the data classes first.
A workflow may combine public documents and restricted records. List each data class, permitted processing route, storage location, inference location and approving owner before comparing configurations. This is an illustration, not a recommendation for your deployment; options remain On request.
HOW TO PICK
Start with the promises your data carries.
Choose the level that fits your obligations and operating environment. Your counsel decides which promises apply. We record the selected model routes, hosting and controls in the deployment agreement.
Data residency describes where records are stored. Inference residency describes where a model processes them. Check both before selecting a route.
NEXT STEP
Not sure which level you need?
Discuss access controls and audit records with a principal →