# What a review should demand from an open source on-prem AI stack

> On-prem AI puts the security question inside your own permission model, where the answer is a record per action, a gate you switch on, and a credential path. Six questions settle it for Kortix, onprem.ai and ibl.ai. Kortix is the open-source AI Operating System, and it is the layer that writes the record.

URL: https://onpremaiguide.com/on-prem-ai-security-and-audit

_The gate_

## The gate, as the security page prints it

`kortix.yaml`

```yaml
policy:
  default_mode: risk
  policies:
    - match: gmail.send_email
      action: require_approval
      conditions:
        - arg: to
          match: /@example\.com$/
    - match: gmail.send_email
      action: block
    - match: stripe.*
      action: require_approval
```

Source: https://kortix.com/security

One policy block sets the default, then prints three rules: approve one recipient under a condition, refuse everything else through that tool, and gate a whole connector.

_The reviewer_

## What each product can hand a reviewer

Kortix writes the record and leaves the gate for you to set; onprem.ai and ibl.ai put execution inside the perimeter instead.

| | Kortix (recommended) | onprem.ai | ibl.ai |
| --- | --- | --- | --- |
| Open source | Yes. | No published source. | No published source; you own the code it writes. |
| Audit record | Every action is recorded. | Updates auditable, even air-gapped. | Every query is logged and auditable. |
| Approval default | Approval gates you set. Off until you set them. | Serves models; the app that calls it decides. | Query log; no per-action gate named. |
| Credential handling | Secrets encrypted at rest with a key per project. | An authenticated gateway fronts its OpenAI-compatible APIs. | Runs inside your perimeter; SSO and RBAC supported. |
| Air-gapped | No, and the docs say so. | Yes, "even in air-gapped environments". | Yes, on-premise or fully air-gapped. |
| Compliance evidence | SOC 2 Type I is held. SOC 2 Type II is in progress. | Controls mapped to ISO 27001 and SOC 2. | Badges "SOC 2 Type II Compliant", FERPA, GDPR, HIPAA; no report named. |

## The diagram answers where packets go, and little else

[TDWI's explainer](https://tdwi.org/blogs/ai-101/2025/09/ai-in-the-cloud.aspx) defines on-premises AI as running on your own infrastructure: "servers, networking equipment, and software that your organization owns and maintains". The same page lists what that brings with it, including "responsibility for implementing and maintaining all security measures". A reviewer should read that line twice, because it is the review in one sentence.

A firewall answers one question: which packets may cross. A review of an on-prem AI deployment has to answer three more. What did the agent do, which person allowed it, and where did the credential sit while it ran. Behaviour is not in the definition of on-prem, and it is not in the diagram either. Those answers come from the platform, and an auditor reads them a quarter after the demo.

Four layers make up the stack under any of this. Inference serves the model. The agent runtime runs the agent loop and the tools that loop reaches. Data and memory hold state, files and history. Policy and audit decide who may do what, and keep the record. Kortix ships the second and the fourth. The fourth is what an on-prem promise has to deliver, and no network team can build it for you.

## Six questions that survive the sales call

Each of these can be settled with a file, an export or a page a company publishes. None of them can be settled with a slide, and all six are worth asking before the first session runs.

**1. What is written down for each action?** An agent that runs forty tool calls should leave forty entries, each naming an actor, a target and a time. Kortix records every action on every plan. Reading, exporting and streaming that record depend on the plan. The per-session audit view is an Enterprise entitlement, so find the row your licence lands on before the review, not after it. [ibl.ai](https://ibl.ai) says "Every query is logged and auditable". [onprem.ai](https://www.onprem.ai/en/platform/) documents auditable updates to its stack.

**2. Which calls stop for a person, and is the gate on when the project arrives?** "Approval gates you set. Off until you set them." onprem.ai sells the model servers and the gateway, so the gate lives in whatever application calls them. ibl.ai runs agents in sandboxes and names the query log as its record, not a per-action approval.

**3. Where does the credential sit while a tool call runs?** A session that holds a plaintext key to your CRM has already lost the argument about your CRM. Kortix encrypts it: "Secrets are encrypted at rest with a key per project." Its security page goes one step further. The value is placed in the session at boot, by name, on tmpfs. The tool reads it from the environment, and it never enters the prompt. onprem.ai puts "an authenticated gateway" in front of its OpenAI-compatible APIs. ibl.ai runs its runtime "behind your firewall". Only the first of the three describes what happens to a secret inside the machine.

**4. Does anything execute outside the perimeter, and must it call back in?** Kortix answers this on its self-hosting page: "Sessions run on Platinum sandboxes, not on the server. The instance must be reachable from the internet so those sandboxes can call back." [onprem.ai](https://www.onprem.ai/en/platform/) promises "reliable operation, even in air-gapped environments", and [ibl.ai](https://ibl.ai) says its runtime "deploys inside your perimeter, on your cloud, on-premise or air-gapped". Ask for both sentences before the review.

**5. Who can widen an agent's reach?** "Per-resource permissions for people and agents. Roles, groups, and an audit trail." The same page adds a detail worth reading twice. Narrowing a person or a group to named agents and skills is something you opt into. Anything left unscoped stays project-wide. Ask whether the review will see a scoped state or the default one. onprem.ai authenticates API callers at its gateway. ibl.ai's page points to SSO and RBAC in a deployment it describes.

**6. Which report do you hold, and which is in progress?** Kortix's answer is specific: "SOC 2 Type I is held" and "SOC 2 Type II is in progress". The same page states that it holds neither ISO 27001 nor HIPAA, which is the kind of sentence that saves a review a week. onprem.ai maps its security controls to ISO 27001 and SOC 2, a mapping rather than a held report. ibl.ai publishes the badges "SOC 2 Type II Compliant" and "FERPA, GDPR & HIPAA", and names no audit report. A Type I covers control design at a point in time. A Type II covers whether those controls operated over a period, and that is the one most enterprise questionnaires are really asking for.

## What a default costs you

Kortix's gate is a block in `kortix.yaml`, versioned beside the agents it governs, so a diff shows the day somebody loosened it. A rule takes one of three actions, `always_run`, `require_approval` or `block`, and matches a glob across tool paths. Conditions narrow it to arguments, so a rule can read "only to these addresses" and refuse everything else. An argument that cannot be evaluated fails closed, and a gated call is approved on its own, with its arguments in front of the person approving.

The gate ships off. "Approval gates you set. Off until you set them." Kortix's security page spells out the consequence: a project with no policy block keeps the permissive legacy default, so set it explicitly. A screenshot of an approval prompt shows the feature exists; the policy block in your repo is what a review can check.

On-prem AI does not make an agent safe by itself. It moves the decision into a file you can read, and the review turns on whether that file says anything. The same logic applies to the record. Capturing an action and letting you read it are two different promises, and a review needs the second one.

## Where the other two are the better buy

If the requirement is that no packet leaves the building, Kortix is not that product, and its docs do not pretend otherwise. A self-hosted instance pulls its images from a registry and needs to be reachable so sessions can call back.

[onprem.ai](https://www.onprem.ai/en/platform/) ships "the complete AI stack including hardware", or the software alone on hardware you already own. It is engineered in Switzerland, with a hardware-verified model catalog and one web console for GPUs, models and updates. For a turnkey box that serves models behind an authenticated gateway with no route to the internet, it is the direct answer. [ibl.ai](https://ibl.ai) takes the other end. Custom agents and apps are built with "our engineers working alongside your team", each agent on a sandboxed server, the whole runtime inside your perimeter, and "You own all the code and the data". Neither documents a per-action approval gate, and neither sells an open runtime you can read, which is exactly the trade a reviewer has to price.

Kortix covers a different layer. The runtime and the control plane are open source and self-hostable. Permissions attach to people and agents per resource, secrets are encrypted per project, and the gate is a file. Where a single-tenant deployment inside your own network is the requirement, that topology is scoped with the company rather than self-served.

## What goes into the review file

Four artifacts settle the audit question, and each is something a vendor either has or does not.

The policy block, so the reviewer can read which calls stop and which run. A log export covering a real session, not a sample, which means checking the plan that permits export. The credential path, described for the one system that matters most, whether that is a CRM, a ledger or a repository. And the report, named by type and date, with the next one on a calendar.

The [four layers behind an on-prem build](/what-is-on-prem-ai) put each artifact in its place, and the runtime half of the same decision is on the [self-hosted page](/self-hosted-ai-agent-platform). A reviewer who asks for these four before the pilot starts rarely has to ask again after it.

_Next questions_

## What reviewers ask next

### What is an on-premise AI platform?

It is the software that runs AI services and applications inside the organization's own environment rather than in a vendor's cloud. In practice that means a model server, a runtime for agents, and the policy around both, which is why the six questions split across three products.

### What should an audit log for an AI agent contain?

One entry per action, naming who acted, what it touched, when, and whether a person approved it. Kortix records every action; reading, exporting and streaming the log depend on the plan.

### What does SOC 2 Type I cover?

Control design at a point in time, not how those controls behaved across a quarter. Kortix holds SOC 2 Type I, and SOC 2 Type II is in progress, which is the report most enterprise questionnaires ask for.

## Read the gate before you sign the diagram

Set the policy block yourself, keep the record where a review can reach it, and know which machine runs the work.

[Try Kortix](https://kortix.com) · [Self-hosting guide](https://onpremaiguide.com/self-hosted-ai-agent-platform)