The foundation architecture behind data sovereignty and the AI runtime
Holding data sovereignty, security, audit traceability, and organizational governance:
an air-gap and on-premise friendly architecture
Connecting knowledge, reasoning, action, and operations into one system:
a reference architecture for the Enterprise AI runtime
/ Design Principles
Architectural design principles
Four design standards every layer shares, so AI can be trusted and operated in an enterprise environment
Grounded answers
Answers rest on the documents, policies, and knowledge models the company holds. When the grounding isn't there, the system says so rather than guessing — which is what keeps hallucination down
Data sovereignty
Runs inside your own infrastructure with no cloud lock-in, including the network-separated environments in finance, public sector, and manufacturing
Composability
Agents, workflows, knowledge, and tools are modules you recombine freely as the work demands
Model neutrality and governance
Choose an LLM by purpose, cost, and accuracy, and keep operations under control through policy, approval, and audit trails
/ Reference Architecture
XGEN 3.0 Enterprise AI architecture
The XGEN 3.0 Enterprise AI layers connecting access, knowledge, reasoning, planning, action, operations, models, and infrastructure
Workflow Orchestration
Shared Orchestration
Public / General LLM
Private / Enterprise LLM
Cloud
On-premise / Private Cloud Air-gap and on-premise friendly
/ On-Premise Security
XGEN 3.0 on-premise and security architecture
An external request reaches internal services, AI models, and data only after passing the authentication gateway and trust boundary. Local resources connect only through explicit user approval and least privilege in Xgent Client, with security, audit, and governance applied across server and local execution.
User zone
Access from the internal network or over VPN
Web browser
JWT cookie · xgen_access_token
Embedded chatbot
chatbot-embed.js · deployed agent
Xgent local execution boundary
Local resources connect through explicit approval and least privilege
Xgent Client
Secure session with the server-side agent
User approval
Allow, deny, or stop each action
Local Folder · OS
Only selected folders and OS capabilities
Local MCP
Scoped private-network and dedicated tools
Frontend
UI rendering and API rewrites
Next.js Frontend
apps/web
Client AuthGuard
Route guard · first-pass UI gating
API routes / rewrite
Forwarded to the gateway
Authentication trust boundary
Above this line is spoofable and external; below it is trusted — only the gateway can carry a request across
Authentication gateway
Converts a JWT into trusted headers
Rust Gateway
JWT parsing and validation
Cookie → user context
x-user-* header injection
id · roles · permissions · superuser
Spoofing blocked
Clients cannot inject these headers themselves
Application services
Permission enforcement and access control
xgen-core
ABAC access control
xgen-workflow
Execution · five-stage access control
Dual approval gate
Deployment plus governance approval required
MCP Station
Sandboxed, isolated execution
AI model zone
Every endpoint stays internal
LLM serving
vLLM · SGLang · llama.cpp (in-house GPU)
Embedding and reranker
Sentence Transformers · vLLM
Guard model
Open guard model · fail-closed
Data stores
Internal network, restricted access
Qdrant
Vector DB
Application DB
Users, policies, metadata
MinIO
Document object storage
Audit log store
Retention policy applied
Applied at every layer · defense in depth
These controls are not tied to one layer — they operate across the whole request path.
Authentication (AuthN)
- ·JWT cookie authentication
- ·Initial SuperUser bootstrap (one time)
Authorization (AuthZ)
- ·RBAC roles
- ·Three-layer ABAC permissions (tier, role, permission)
- ·Least privilege for local folders, OS, and MCP
Data protection
- ·PII masking
- ·Guardrails (blocked on failure)
- ·Blocklists and risk grading
Governance
- ·Dual deployment and governance approval
- ·Scheduled reviews (D-5 cadence)
- ·Risk assessment
Audit and traceability
- ·Trace plans, tool selection, and file access
- ·Record server/local results and data exports
Isolation and boundaries
- ·MCP sandbox execution
- ·Kill switch for agents, sessions, and local links
- ·On-premise and air-gap support
/ XGEN Platform
XGEN 3.0 platform architecture
An Enterprise AI platform that joins server-side control with local execution and carries plans, tools, and work context across environments without breaking continuity
CONTRACT
Document parsing → embedding → hybrid retrieval → rerank → context injection
Cross-cutting control across every layer
XGEN 3.0 runs on a Harness Runtime that turns goals into plans and a centrally governed Server Agent Runtime. Only when needed, Xgent Client connects approved local folders, OS capabilities, and MCP tools, then synchronizes results and state. Least privilege, user approval, execution traces, and an immediate kill switch extend the existing AI Platform Core, RAG, foundation-model, and infrastructure capabilities.
See the XGEN product/ Code Assistant
Code Assistant architecture
Natural-language questions and code searches run through indexing, hybrid retrieval, and AI reranking to produce a code answer with evidence behind it
- Source collection and preprocessing
- Indexing and embedding
- Keyword search (BM25)
- Vector similarity search
- AI reranking
- LLM answer generation
/ CI/CD
GitOps deployment pipeline
From source change to production — container image builds and declarative GitOps sync make each deployment a controlled one
GitOps and declarative
Git is the single source of truth — manifests define the cluster state and sync it
Controlled releases
Branch plus merge request required (no direct push to main), with manual sync controlling when a deploy lands
On-premise and air-gapped
Image export/import moves builds across the air gap, with per-site environment separation (dev/stg/prd)
Observability
Prometheus and Grafana monitor state, logs, and traces after deployment