GOVERNMENT · PUBLIC SECTOR

Government AI: Inside the Authorization Boundary, Under Public Records Rules

The procurement will take longer than the deployment. Design for the authorization, not around it.

Written by Jakub Rusinowski · Last updated 2026-08-01 · Hardware figures computed by our VRAM engine

This page is practitioner guidance on deployment mechanics, not legal advice — involve your counsel or DPO for decisions about your specific obligations.

Government AI deployment is governed by where the system boundary sits. A hosted commercial model brings a new external service that must be authorized at the right impact level before agency data touches it; an open-weight model running on infrastructure already inside your authorization boundary inherits the controls and the ATO you have. That is why public bodies with sensitive data and slow procurement cycles increasingly self-host: it converts a multi-quarter authorization problem into a change within an existing boundary.

Why this is hard

What the deployment gives you

No new authorization boundary

Inference on infrastructure already covered by your ATO means the AI capability lands inside a boundary that has been assessed, rather than beside it. The security review becomes a change to a known system instead of an authorization from scratch.

Records obligations satisfied by default

Prompts, retrieved context, and completions captured into your records system with retention set by schedule. When a records or disclosure request arrives, the material exists and is producible rather than expired in a vendor's rolling log.

Mapped to controls your assessors know

Access control, audit and accountability, boundary protection, and configuration management from NIST SP 800-53 apply to the AI system in exactly the language your assessment already speaks. No new control framework to invent.

Human accountability preserved

Assistive by design: the model drafts and retrieves, a named official decides. Determinations affecting rights, benefits, or entitlements keep a person accountable for the outcome, which is what the governance policies actually require.

Inside the boundary you already had authorized

The design goal is to add capability without adding a boundary. Everything sits within the existing accreditation footprint, and the model artefact is the only thing that comes from outside — reviewed and staged once, like any other software dependency entering an authorized system.

Inside the boundary you already had authorizedAuthorization boundary — existing ATO. 1. Vetted model artefact: Reviewed, hashed, and version-pinned before it enters the boundary. 2. Staff workstation: Agency SSO; role and program area attached to each request. 3. Gateway & records capture: Writes the interaction to the records system before and after inference. 4. Inference server: On-prem or authorized GovCloud GPUs at the correct impact level. 5. Program document index: Policy, regulation, and case material scoped to program and clearance.AUTHORIZATION BOUNDARY — EXISTING ATOVetted model artefactReviewed, hashed, andversion-pinned before itenters the boundary.Staff workstationAgency SSO; role andprogram area attached toeach request.Gateway & recordscaptureWrites the interaction tothe records system beforeand after inference.Inference serverOn-prem or authorizedGovCloud GPUs at thecorrect impact level.Program document indexPolicy, regulation, andcase material scoped toprogram and clearance.

What you have to satisfy

Models that fit this deployment

模型VRAM (Q4)可运行于上下文许可
Qwen 3 32B
Program office tier — 24 GB card — Drafting, summarisation, and grounded retrieval over regulation and policy material.
ollama pull qwen3:32b		20.6 GB24 GB GPU (RTX 3090/4090)
Mac: 32 GB 统一内存		125KApache 2.0
Llama 3.3 70B Instruct
Agency tier — 48 GB class — Longer statutory and case documents; single pro card, version pinned for the record.
ollama pull llama3.3:70b		43.1 GB2×24 GB GPUs or 48 GB card
Mac: 64 GB 统一内存		128KLlama Community
GPT-OSS 120B
Shared-service tier — 2×48 GB — A department-wide capability where the alternative is a commercial API and a new ATO.
ollama pull gpt-oss:120b		71.3 GB2×48 GB GPUs / big unified memory
Mac: 96 GB 统一内存		128KApache-2.0

Deploying AI inside an authorization boundary?

We help public bodies deploy AI on infrastructure they already operate — boundary and impact-level analysis, records capture design, hardware sizing, and the control mapping your assessors will work from. Vendor-neutral: no infrastructure, no platform, and no model to sell you.

Ask about a workshop →

常见问题

Can government agencies use commercial AI services?
Sometimes, and the constraint is authorization rather than policy preference. A hosted AI service handling federal data generally needs FedRAMP authorization at an impact level appropriate to that data, and several providers now hold authorizations at the lower and moderate levels. What does not transfer is the authorization itself covering your specific use — the agency still assesses and accepts the risk. For sensitive categories, or where procurement timelines make a new authorization impractical, deploying open weights inside an already-authorized boundary is frequently the faster route.
Do FOIA and public records rules apply to AI prompts?
Treat them as though they do. Records law generally attaches to material made or received in the course of official business, and a prompt that informs an agency decision fits that description comfortably. The practical consequence is architectural: capture the interaction into a records system with retention by schedule, rather than letting it live in a tool's temporary log. Agencies that skip this discover the problem when the first request arrives and the material has already aged out. Confirm the specific classification with your records officer.
What is the difference between GovCloud and on-premise for AI?
Both can sit inside an authorized boundary; they differ in who operates the hardware and how quickly you can scale. Authorized government cloud regions give you elasticity without a datacentre, at the cost of an ongoing provider dependency and a boundary that includes their service. On-premise gives you the tightest control and the simplest boundary story, which matters most for the highest impact levels and for genuinely disconnected sites. Because the weights are portable either way, this is a deployment decision you can revisit without rebuilding.
How do we handle AI use cases that affect people's rights or benefits?
Keep a human accountable for the determination and document the system accordingly. Federal AI governance policy singles out rights-impacting and safety-impacting uses for additional practices — impact assessment, testing, monitoring, and public transparency — so the first step is classifying honestly which category a use case falls into. In practice most successful public-sector deployments start well away from that line: drafting correspondence, summarising case files, and answering staff questions against policy documents, where the official still decides.
Is this affordable for a smaller public body?
More often than expected, because the hardware requirement is modest for the workloads that matter. A single 24 GB GPU running a 32B-class model serves a program office for drafting and retrieval, at a capital cost comparable to a few staff laptops and no per-token bill afterwards. The larger cost is usually the integration and governance work rather than the GPU. Start with one well-scoped use case, size it with our compatibility checker, and expand once the value is demonstrated rather than procuring for a hypothetical peak.

Go deeper