How do you evaluate whether an AI coding tool actually supports air-gapped deployment or just claims to
Working on a procurement assessment for a defense contractor client. The requirement is air-gapped AI coding assistance where no data traverses any network boundary under any circumstance, including license validation and telemetry. Not air-gapped with exceptions, like fully disconnected.
Most vendors that advertise on-premises deployment still have egress somewhere. License validation against an external endpoint. Telemetry calls on an interval. Model update processes that require internet access. Any of these disqualifies the tool for this use case because in a classified environment every network flow has to be documented and justified.
How are people actually verifying these claims during procurement? Asking the vendor's sales team gets you a yes every time. I'm looking for what documentation to request, what architecture questions to ask, and whether anyone has actually validated a fully air-gapped deployment in a classified or restricted environment.