Private AI is a control problem: where do prompts, documents, and tool outputs live?
Patterns that work
- Gateway / proxy in front of every model call (logging, DLP, allowlists)
- Prompt-injection guards on ingress for untrusted text
- Local or VPC-hosted weights for the sensitive slice; cloud frontier for the rest
- Red-team loops before agents get production tools
Practical split
Use local / VPC models for private corpora. Use the current frontier board (/leaderboard) for hard reasoning when contracts allow. Don’t confuse a security brochure with a measured breach-cost reduction — instrument first.