Proof. The evidence behind the layer.

In a network-separated (air-gapped) environment, external LLMs could not be used at all, and concern over classified-context exposure blocked AI adoption entirely.

LLM Capsule encapsulates the sensitive context locally — only the protected capsule, not the original, is processed by the external LLM, and the result is rehydrated locally inside the boundary. The raw classified context never crosses the boundary, aligned with N2SF guidelines.

Sensitive context is substituted with local stand-ins before processing and reconstructed locally after — no original data leaves the enclave.

Every encapsulation/restoration event is logged locally, so any processed request can be reconstructed and inspected within the boundary.

Internal documents — contracts, HR records, customer files holding personal and confidential information — could not be sent to ChatGPT, Claude, or Gemini for summarization or search. The security team blocked it.

LLM Capsule detects and substitutes personal and confidential fields locally before the request reaches an external LLM, then restores the original values in the response — so staff can summarize and query internal documents without raw data leaving the organization.

The LLM Capsule gateway was placed between internal tools and the external LLM. Detection covered names, contacts, IDs, and account/contract identifiers; raw values stayed in the local token vault.

Each request's substitution is logged and bound to a fixed release state, so a given document-Q&A run can be reconstructed for audit.

Real patient records required for model validation could not be accessed due to regulatory constraints. The validation pipeline stalled.

Differential-privacy-safe (DP-safe) replacement records matching real distribution characteristics — without containing real identifiable information — unblocked the validation pipeline.

Non-accessible real records were replaced with DP-safe equivalents. Data distribution preserved, compliance review passed, validation pipeline resumed without modification.

The replacement dataset is versioned and bound to a fixed data state, so the validation run is reproducible with the same distribution on demand. Audit trail maintained throughout.

OT/ICS network data carried sensitive operational details, so it could not be sent to an external AI for automated threat analysis.

Structure-preserving de-identification lets an AI agent analyze the network data and answer threat questions — sensitive values replaced with stand-ins while relationships are preserved. (Integrated with a global OT security platform's detection solution.)

Network-data sensitive fields are substituted while topology and relationships are kept intact, so the agent can reason over realistic context.

The de-identified dataset and the agent's analysis are bound to a fixed data state, so the same analysis can be re-run and verified.

Users exporting sensitive aggregate statistics required manual, per-desk de-identification and release review — inconsistent and hard to audit.

A per-desk de-identification module plus a multi-agent pipeline detects, traces, and de-identifies personal information in aggregate data, automating and standardizing the release-review process.

Release State fingerprints the data before and after de-identification, so which records were transformed — and how — is traceable for audit.

A prior release can be replayed against its bound Release State, reproducing the screening process for regulatory inspection.