Mission control for on-premises airgap deployments. Inspect zero-trust Ambient ztunnel L4 throughput, socket PII redaction streams, model weight allocations, and dynamic FinOps routing arbitration.
| Node ID | IP / Role | ztunnel L4 | Waypoint L7 | mTLS State |
|---|---|---|---|---|
worker-node-01 |
10.240.0.12 (GPU L40S) | 1.28 GB/s | Active (Envoy 1.31) | SPIFFE Verified |
worker-node-02 |
10.240.0.13 (GPU L40S) | 1.44 GB/s | Active (Envoy 1.31) | SPIFFE Verified |
ingress-gw-01 |
10.240.0.8 (Edge) | 890 MB/s | Active (ext_authz) | SPIFFE Verified |
control-mgr-01 |
10.240.0.4 (Etcd/Raft) | 120 MB/s | Bypass | SPIFFE Verified |
| Policy Name | Target Namespace | Inspection Filter | Model Target | mTLS Strictness | Cost Impact |
|---|---|---|---|---|---|
core-banking-airgap |
finance-ingress | Enforced (IBAN / Tax ID / SSN) | Local vLLM (Cluster FRA-01) | PERMISSIVE_NONE (Strict) | €0.00 / token (100% On-Prem) |
clinical-records-hipaa |
clinical-research | Enforced (ePHI / Diagnostic) | Local Triton (2x L40S) | STRICT (SPIFFE mTLS) | €0.00 / token (100% On-Prem) |
dev-sandbox-general |
ai-serving | Enforced (AWS/GCP API Keys) | Mistral-Small + Frontier Cloud | STRICT (Ambient ztunnel) | 81.4% Routed to Local Silicon |
trading-telemetry-lowlat |
core-banking | Enforced (BIC / Account PII) | Local Qwen-2.5-Coder (FP8) | STRICT (ztunnel L4 mTLS) | €0.00 / token (Zero Cloud Hop) |
Flat amortized datacenter compute cost. Zero per-token marginal billing. Zero egress egress tax. Prefix cache reclaims 62% of repeated schema payloads.
Uncontrolled compounding developer IDE completions, continuous schema indexing, and prompt engineering leaks accumulate uncapped monthly bills.
| Prompt Classification & Task Condition | Assigned Target Model Weight | Arbitration Policy | Hourly Token Volume | Monthly Realized Savings |
|---|---|---|---|---|
| Developer IDE Autocompletion & Unit Tests | Qwen-2.5-Coder-32B @ FP8 (Local vLLM) |
Role: engineering-dev (Airgap local) | 3,420,000 tok/hr | €7,440 saved |
| Regulated Customer Banking Records & PII | Mistral-Small-24B-Instruct-v0.2 (Local 4-bit) |
Data: BaFin/GDPR PII (Mandatory Local) | 2,180,000 tok/hr | €6,840 saved |
| RAG Document Vector Embeddings & Search | bge-m3 @ FP16 (Local Triton Server) |
High-throughput batch embedding | 8,900,000 tok/hr | €2,100 saved |
| Multi-Hop Frontier Reasoning (Approved Staff) | Sanctioned Frontier Cloud (Tier 1 API) |
Gated by Okta Principal policy (Budget Capped) | 420,000 tok/hr | €2.5k/mo Hard Cap |
| Model Identifier | Quantization | Hardware Allocation | VRAM Footprint | State |
|---|---|---|---|---|
Mistral-Small-24B-Instruct-v0.2 |
4-bit AWQ | 2x NVIDIA L40S (PCIe) | 16.4 GB / 96 GB | LOADED |
Qwen-2.5-Coder-32B-Instruct |
FP8 Native | 2x NVIDIA L40S (Tensor Parallel 2) | 34.8 GB / 96 GB | LOADED |
BAAI/bge-m3-embeddings |
FP16 TensorRT | NVIDIA Triton Node 01 | 2.4 GB / 96 GB | LOADED |
Llama-3.3-70B-Instruct |
4-bit AWQ | Standby Warm Pool (Dell OEM SKU-C) | 44.2 GB (Staged) | WARM STANDBY |
vLLM PagedAttention isolates memory blocks into 16-token virtual pages. When concurrent request volume surges, the prefix radix tree sheds non-critical KV blocks deterministically without dropping active client connections.
| Regulatory Article | Requirement Description | Mastrion Automated Control | Audit Evidence Artifact | Compliance Status |
|---|---|---|---|---|
| Article 10 | Data Governance & Lineage | Socket PII filter + training lineage validation | sha256:lineage-tree-v2.json |
100% COMPLIANT |
| Article 11 | Technical Documentation | Automated cryptographic AIBOM generation | /models/qwen2.5.aibom.json |
100% COMPLIANT |
| Article 12 | Record-Keeping & Logs | Immutable JSON-LD Merkle audit receipts | receipt.mastrion.com/v1/attest |
100% COMPLIANT |
| Article 13 | Transparency & Notice | In-line L7 response headers & provenance tags | X-Mastrion-Model-Attestation |
100% COMPLIANT |
| Article 14 | Human Oversight | Zero-egress circuit breakers & RBAC SSO auth | policy.mastrion.io/oversight |
100% COMPLIANT |
| Article 15 | Cybersecurity & Robustness | In-line jailbreak filter + ambient mTLS ztunnel | cve-assurance-report-36mo.pdf |
100% COMPLIANT |
Export cryptographically signed compliance packages for BaFin, SEC, HIPAA, or BSI auditors. Includes full prompt-response hash trails, redaction logs, and hardware isolation certificates.