Air-gapped operation¶
An air-gapped RG Cluster is a first-class mode, not a stripped-down subset. It runs with local identity, local RBAC, and local audit, and delivers full device management with zero external connectivity. If it is ever later reconnected, it reconciles safely, and it can export its audit on demand. Everything an operator does on a connected cluster, they do on an air-gapped one.
A first-class mode, not a subset¶
Air-gapped operation is what the cluster architecture already does, with the cloud simply absent. Because a cluster is designed local-first, none of its core functions depend on external reachability: identity, pairing, reverse channels, configuration, adapters, telemetry, RBAC evaluation, and audit are all resolved inside the cluster. Removing external connectivity therefore removes nothing operational — it does not disable features, thin out RBAC, or reduce audit. This is the important distinction from platforms that treat offline as a degraded fallback: on RG, an air-gapped cluster is the same execution plane running within a closed boundary, delivering the full management surface rather than a limited emergency mode.
Local identity, RBAC, and audit¶
An air-gapped cluster carries its own complete governance locally. Local identity means devices authenticate to the cluster with the keys they generated at pairing, and users authenticate against the cluster's own identity, with no call to an external service. Local RBAC means every authorization decision — the same two-tier organization-plus-cluster model used everywhere — is evaluated within the cluster against its local roles and permission catalog. Local audit means every consequential action is recorded to the cluster's own investigation-grade trail, transactionally with the action. Nothing about access control or accountability is weaker for being disconnected; the cluster holds the full apparatus for governing and proving its own operation.
Safe reconciliation on reconnection¶
Some air-gapped clusters are permanently isolated; others may be reconnected deliberately, for example to sync with the cloud layer during a maintenance window. When reconnection is permitted, the cluster reconciles safely rather than assuming either side is authoritative for everything. Local operation that happened during isolation is preserved and merged in a defined way, and the cluster's local audit — the record of what occurred while disconnected — is retained and can be replicated upward for long-term retention. Reconnection is treated as a controlled event with a predictable outcome, so an operator can move a cluster between isolated and connected states without risking loss or contradiction in identity, configuration, or the audit record.
Audit export on demand¶
Because an air-gapped cluster retains its audit locally, it can export that audit on demand to satisfy review, compliance, or transfer requirements without needing a live connection. The trail carries the same investigation-grade detail as anywhere else — actor, target, outcome, source, and correlation identifier per event — so an export from an isolated cluster is a complete record, not a summary. This matters for the environments air gaps serve: an auditor or authority can be handed a full local record produced entirely within the controlled boundary.
Who needs it¶
Air-gapped operation serves environments where external connectivity is disqualifying. Defense and public-safety operators run systems that must stay within a controlled network. Critical-infrastructure operators isolate control systems from the public internet by mandate. Classified sites forbid any external data path outright. For all of them, RG offers the same fleet management they would get on a connected deployment — outbound-only device tunnels, device shadows, adapters, native GUI access, two-tier RBAC, and full audit — running entirely inside their boundary with nothing leaving it.