Private inference architecture example for internal documents

Consider a team preparing summaries of internal Spanish and English documents. It wants a draft containing main points and references to source passages, reviewed by a person before use. The system does not send messages, approve decisions or modify other systems. This is an illustrative proposal for reasoning about controls, not a description of a Primedefence deployment or customer success story.

Assume thirty authorised users and six hundred documents per week for the exercise. These are invented planning figures, not promised capacity. Input lengths, arrival patterns and review effort remain to be measured. The business requirement is to preserve existing permissions and retain the manual process if the service stops. The private AI guide covers decisions that should precede this design.

Components may share infrastructure. This table describes functions and responsibilities rather than requiring six separate services. The illustration is conceptual and does not certify network isolation. A final deployment diagram must show actual paths and dependencies.

The application receives a user identity and document identifier. It checks authorisation before fetching content. For an authorised document, it validates format and size, prepares instructions and assigns a job identifier. The queue controls admission and deadlines. The engine receives only the context needed for the draft, without credentials that could extend access to other documents.

Output passes through structural validation and is presented with references the reviewer can open while still authorised. Format validation does not establish truth: the person checks material claims. The draft is not automatically distributed. This first version does not add search across the document estate. Adding retrieval later would require permission-preserving retrieval and new quality tests rather than merely connecting an index.

The deployment diagram must identify where inputs, outputs, temporary files and logs are processed, who administers each system and how support gains access. Selecting private cloud or customer premises does not answer these questions by itself. The deployment comparison helps assess responsibilities before selecting location or infrastructure.

For this exercise, propose ordinary telemetry containing identifiers, versions and timings, avoiding complete text when unnecessary. Agree draft retention with the process owner rather than assuming a universal policy. Examine temporary files, backups and evaluation samples through the data inventory. Trace the system using synthetic markers before introducing sensitive information so unexpected copies can be identified safely.

Prepare a user without document permission, an expired session and a document containing instructions to reveal other information. Check that access control prevents the unauthorised read and that the model has no tool capable of bypassing that boundary. Treat document text as untrusted content even when it comes from the internal repository. Internal origin does not make every embedded instruction appropriate to execute.

The security guide develops these checks. OWASP’s prompt-injection guidance describes threats involving content processed by a model. In this example, omitting action tools reduces the reach of an induced response, but does not eliminate misleading-summary risk. Keep review and provenance visible, and do not treat the model’s refusal message as proof that the application boundary worked.

Build a set covering both languages, short and long documents, contradictions and absent information. Assess coverage, correct references, unsupported claims and review time. Reserve cases that are not used to tune instructions. Agree criteria before execution. This article assigns no scores and does not assert that any configuration has passed those criteria; the purpose is to make the required evidence explicit.

Six hundred weekly documents do not size the engine. Measure tokens and arrival patterns, then test simultaneous requests using the capacity protocol. Calculate cost per accepted task, including review and operations. If work concentrates within one hour, that concentration must be tested even when the weekly average appears modest. Include rejected and retried work in the results.

Simulate an engine outage and an unavailable document dependency. Users should see that a draft is unfinished and be able to continue manually. Bound retries so they do not create multiple indistinguishable jobs. After restoration, verify versions, permissions and pending-work handling. Do not send documents to an alternative endpoint unless that route has already been approved and tested.

The final decision can be limited progression, revision or stopping. Record evidence and unresolved issues through the pilot plan, and responsibilities through the procurement checklist. Turning this example into a real proposal requires private inference services to establish the organisation’s data, workload, controls and delivery scope. The example supplies questions and testable boundaries, not a ready-made claim of production suitability.