Inteltech
What It Takes to Put an Assistant on SIPRNet
The assistant is the easy part. A classified deployment turns on the authorization boundary, the model catalog inside it, and who reviews the markings.
The interesting question about an AI assistant on a classified network is not whether it works. It is what the authorizing official can sign for.
Those are different questions, and the second one is slower. A productivity assistant such as Microsoft's Copilot is a familiar artifact. A model that generates text inside a Secret enclave is a new data flow, a new supply chain, and a new way for classified information to end up somewhere it should not be.
A provisional authorization is a scope
A provisional authorization is not a verdict on a product. It is a statement that a defined system, inside a defined boundary, has met a defined set of controls for a defined set of data.
Four definitions, four ways for a deployment to be misunderstood.
The boundary is the first. What is inside it, what connects to it, and what crosses it. An assistant that reaches a document store, an email system, and a search index has three data paths, and each one has to be inside the authorization or explicitly severed.
The data is the second. A system authorized for Secret is not authorized for a different classification, a different compartment, or a different coalition releasability. Those are different decisions with different officials.
The controls are the third. Access control, audit, incident response, configuration management, and continuous monitoring are not a checklist that a product inherits from its commercial twin. They are implemented for this boundary.
The duration is the fourth. A provisional authorization has conditions and a review cadence. It is not permanent, and it is not transferable to the next version of the product.
The model catalog is inside the boundary
Here is the part that surprises program teams. The cloud can be authorized while the model is not.
Microsoft's own general availability roadmap (opens in a new tab) makes the distinction visible. In the IL6 environment, the AI platform and the search layer are listed as generally available. The model catalog and the machine learning service are listed as forecasted. Copilot Studio is listed as not available.
That is not a criticism of Microsoft. It is how authorization works. A platform is a place to run things. A model is a specific artifact with weights, a tokenizer, an evaluation record, and a behavior profile. Each model is a decision, and the decision has to be made again when the model changes.
An assistant is a layer on top of that. If the model underneath is not in scope, the assistant is a user interface with nothing authorized to talk to.
The failure mode is markings, not answers
The public conversation about AI on classified networks focuses on whether the model will say something wrong. The operational concern is duller and more serious: whether the output carries the right markings.
Classification markings are not decoration. They tell the reader what they are allowed to do with the paragraph in front of them. A generated summary that merges a Secret paragraph with an unclassified one has to be marked at the higher level, in every portion, with the right caveats.
A language model does not know the classification of its inputs unless the system tells it, and the system's ability to tell it depends on how the source documents are marked and how the retrieval layer handles them. That is an engineering problem in the pipeline, not a prompt.
The policy answer is human review. Every generated product gets reviewed for classification accuracy before it moves. That is the right answer, and it has a cost: the reviewer has to be competent to catch the error, which means the time savings are smaller than the demo suggests.
What to ask before a pilot
Five questions, in order, will tell you whether a classified assistant deployment is real or a briefing.
- What is in the authorization boundary? Name the model, the version, the retrieval store, and every system it touches.
- Which model version is approved, and what happens when it changes? A new version is a new artifact. If nobody owns that decision, the deployment has an expiry date nobody is tracking.
- How are source markings carried into the output? If the answer is "the model applies them," ask for the test that proves it.
- Who reviews generated products, and against what standard? A review process with no written standard is a person doing their best.
- What does the audit record contain? The prompt, the retrieved documents, the model version, and the output. Without the retrieved set, you cannot reconstruct why the answer looked right.
The productivity gain is real and smaller
I do not doubt that an assistant helps an analyst draft, summarize, and search. The commercial evidence is strong and the task is a good fit.
The classified version of that gain is discounted by the controls around it. Review time, marking checks, and the inability to reach the open web all take a bite. The net is still positive for document-heavy work.
The mistake is planning the program around the demo number. Plan it around the review step, because that is the step that decides whether the tool saves time or moves work from the analyst to the reviewer.
An assistant on a classified network is not a model milestone. It is an accreditation milestone, and accreditation is a series of narrow decisions that do not compress.