Run AI agents on government networks, air-gapped, with FIPS 140-3 builds and signed policy.

01The problem: tools that phone home and share a kernel

Agencies and contractors want agents for document triage, code modernisation and cyber tooling, on networks with no route out and data marked as controlled unclassified information (CUI). Most agent tools assume a cloud service, a licence check over the internet, or containers that share one host kernel across workloads of different sensitivity.

Assessors working from NIST SP 800-53 and SP 800-171 ask what this machine is configured to do, and for evidence. kosa8's answer is a set of controls you can inspect and a command that reports them. It is configuration evidence, not an authority to operate.

02Installs and runs with no network

The offline bundle carries the binaries, the guest kernel and root filesystem, and a SHA256SUMS file the installer checks before copying anything; the installer contains no URL. The guest ships alpine inside it, so a container runs before the machine has seen a registry, and other images arrive as tar files through kosa8 load. A signed site licence is verified locally, with no activation and no revalidation.

03FIPS 140-3 builds from a private channel

Government builds compile every binary against Go's FIPS 140-3 cryptographic module, using the module snapshot that has completed CMVP validation, with the module switched on at run time. They are published to a private release channel with a CycloneDX SBOM and a keyless cosign signature. kosa8 version reports the module, and a signed policy can require it: a daemon built without it refuses to start.

04One signed policy, enforced on every machine

An org policy names the registries and MCP servers allowed, denies egress by default and requires containers to run in a sandbox VM. It is signed with your ed25519 key and checked against the pinned public key on each host. A policy that fails verification stops operations instead of being ignored, so tampering cannot quietly switch enforcement off.

05CUI labels that only rise

Sandboxes and snapshots carry a classification such as CUI or CUI//SP-EXPT//NOFORN. Forks and restores inherit it and may raise it, never lower it; lowering takes signed approvals from two people by default. Under the default lattice a CUI snapshot cannot be pushed or exported, and a CUI sandbox cannot mount host folders, until your policy says where they may go.

06Two-person integrity, including CAC and PIV keys

Approvers listed in the policy sign with ed25519 keys, or with ECDSA P-256 or P-384 for CAC and PIV cards. A person with several keys counts once. Requests and approvals are files, so the flow works across an air gap.

07Evidence for assessors

kosa8 doctor --compliance checks the machine against a hardening baseline (validated crypto, signed policy, default-deny egress, an intact audit chain, private state, disk encryption and more), maps each control to an 800-53 family, and exits non-zero when a required one fails. Audit entries export as CEF or forward to syslog over mutual TLS, Splunk HEC or HTTPS.

08How to start

Evaluate on a connected test machine first, then move to the offline bundle and a site licence for the enclave.

1. Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.

   curl -fsSL https://kosa8.com/install.sh | shCOPY kosa8 daemon startCOPY

2. Create a sandbox with no network at all, then see which baseline controls the machine still fails.

   kosa8 sandbox create eval --egress denyCOPY kosa8 doctor --complianceCOPY

09Questions

Does kosa8 run fully air-gapped?

Yes. The offline bundle installs with no network and checks its own SHA256SUMS first, KOSA8_OFFLINE=1 makes every outbound call fail immediately instead of hanging, and a signed site licence is verified locally with no activation or revalidation.

Is kosa8 a FIPS 140-3 validated module?

kosa8 is not itself a validated module. Its government builds use Go's FIPS 140-3 cryptographic module, built from the snapshot that completed CMVP validation, and kosa8 version reports it. A signed policy can require that build, and a daemon without it refuses to start.

Does kosa8 give us an ATO?

No. kosa8 doctor --compliance checks the machine's configuration against a baseline mapped to NIST SP 800-53 control families and exits non-zero when a required control fails. That is configuration evidence for an assessor, not an authorisation.

Does it run on Windows desktops?

Sandboxes run on Apple silicon Macs and x86-64 Linux. Windows 11 on x86-64 runs them in WSL2 as a preview, and other machines can drive a Linux worker with the same commands.

10Further reading

• How do I run an AI coding agent air-gapped?
• How do I run an AI agent sandbox on my own machine instead of the cloud?
• How do I require human approval before an AI agent runs a risky command?
• Docker containers vs microVMs: which isolates an AI agent better?
• AI agents in government and defence: securing production systems
• Self-hosted AI sandbox options

11Sources

• NIST: FIPS 140-3, Security Requirements for Cryptographic Modules
• NIST: Cryptographic Module Validation Program
• Go: FIPS 140-3 compliance
• NIST SP 800-53 Rev. 5
• NIST SP 800-171 Rev. 3
• National Archives: Controlled Unclassified Information
• kosa8 docs: Governance

12Get kosa8

Install kosa8 on a test machine today. FIPS builds and offline site licences come with the Enterprise and Government plans; ask through the pricing page.