A client says data cannot leave their environment. How...

Model access moves in-perimeter. Depending on what the client’s cloud already looks like, that’s a managed model service running inside their own cloud account and region, requests routed through an internal gateway they control, or self-hosted open-weight models on their own compute if even a managed in-region service isn’t acceptable. Provider choice becomes a configuration decision behind that gateway rather than a hardcoded commitment to one vendor.

The part that’s easy to get half-right: it’s not just the model call. Retrieval and vector storage stay inside the boundary too. And so does logging and evaluation data — prompts and outputs captured for observability or eval are exactly the content the client asked to keep in, and an observability pipeline that ships them to an external tool quietly violates the constraint the rest of the architecture was built to satisfy.