Three canonical deployment modes are governed by Principle 11 (Open by default, sovereign by design). The deployment mode of a business instance is a first-class configuration field and constrains the model routing available to every agent in that instance.

Mode 1 — Cloud-connected

All platform components run self-hosted, except the inbound Hookdeck Event Gateway, which is required in every mode. Data flows to model providers for inference only; no business data is stored externally.

Inference: External model APIs

Suitable for: Organisations comfortable with standard cloud data processing agreements.

Mode 2 — Self-hosted hybrid

All platform components run self-hosted, except the inbound Hookdeck Event Gateway. The model mix is declared per agent in the runtime policy.

Inference: Mixed — external APIs and local models via Ollama or vLLM

Suitable for: Organisations wanting local inference for sensitive workflows.

Mode 3 — Air-gapped (fully local)

All platform components run self-hosted except the inbound Hookdeck Event Gateway, Mode 3’s single declared external dependency. No outbound connection or external API call originates from the customer’s infrastructure, and no business data leaves it. Inbound event payloads are held in transit by Hookdeck before delivery; this inbound path must be disclosed to, and accepted by, the customer. Never describe Mode 3 as “zero external connections”.

Inference: Local models only, no outbound connection or external API call

Suitable for: Regulated industries, government, defence, and any environment where data sovereignty is non-negotiable, provided its policy tolerates the single inbound Hookdeck path.

What runs where 

flowchart LR
    HK["Inbound Hookdeck Event Gateway: required in every mode"]
    subgraph m1["Mode 1: Cloud-connected"]
        p1["Platform components: self-hosted"]
        i1["Inference: External model APIs"]
        p1 --> i1
    end
    HK -->|inbound events| p1
    subgraph m2["Mode 2: Self-hosted hybrid"]
        p2["Platform components: self-hosted"]
        i2["Inference: Mixed — external APIs and local models via Ollama or vLLM"]
        p2 --> i2
    end
    HK -->|inbound events| p2
    subgraph m3["Mode 3: Air-gapped (fully local)"]
        p3["Platform components: self-hosted"]
        i3["Inference: Local models only, no outbound connection or external API call"]
        p3 --> i3
    end
    HK -->|inbound events| p3

Invariants

  • air_gapped_no_cloud_uri — An air-gapped business instance cannot declare cloud model URIs in any agent runtime policy. Enforced by the OS as a validation invariant.
  • hookdeck_ingress_exception — The inbound Hookdeck Event Gateway is the one accepted exception to Principle 11, recorded in ADR-OS-013, and is required in all three modes. In Mode 3 it is the single declared external dependency; no other external dependency is permitted.
  • managed_data_plane_modes_1_2_only — A data plane is never pooled across tenants. The Synedrix-operated (managed) variant is available only in Modes 1 and 2; Mode 3 is self-operated until a separate decision records otherwise.