Fleet control, without the cloud.
The operations plane for Atlas™ pods, designed for air-gapped fleets. One inventory, one estate graph, one governed decision surface, all running on the box, and still working when the link is gone.
Every mainstream network management tool assumes a reachable controller in a data center. In a fight, that is exactly the assumption that fails.
Forward pods spend real time dark. Anything that phones home to decide is dead weight when decisions matter most.
A pod is compute, power, thermal, radios, edge devices and operational technology. Watching only IT is blind to half the failure surface.
An unlogged autonomous action is a finding, not a feature. Every action must be reversible, policy-bound and provable.
A grounded assistant and a cross-domain correlation engine that help the operator see what is actually happening.
A predictive digital twin that forecasts failures from telemetry the pod already holds, with no cloud analytics service.
Governed autonomy policies that decide how the pod protects the mission when no human is in the loop.
An IT-side intrusion and an OT-side anomaly from the same event become one incident with one identity, not two disconnected alerts. A cloud console never had both domains on one model.
Every two minutes, declarative DDIL policies decide when to shed load ahead of a power tip, quarantine a compromised edge system, or fail over to a healthy peer. The actions reach real systems: a load shed unloads the model from the pod’s runtime, and a quarantine blocks the device’s traffic at the gateway. Each is proposed for approval when an operator is on the loop, and autonomy refuses any action it cannot roll back.
Every governed action passes a fail-closed policy gate, with Belay™ available as a second, deny-only layer, and is written to a hash-chained audit record that each pod signs with its own key, so even a rewrite with direct database access fails verification.
Forecasts time-to-threshold for silicon temperature, power headroom, storage and component health (from the node’s system error rate) with an explainable model that reports its own confidence, and extends to coolant where a coolant sensor is attached.
Learns each industrial device’s normal behavior and flags deviation from its own baseline, while operator-set safe bands stay a hard floor from day one.
Pods detect a lost peer from heartbeats within seconds, serve its state as last-known, queue every change bound for it and drain the queue when the link returns. When the primary controller is lost, the healthy peer takes over, and the old primary steps down when the link heals. Proven on a two-pod reference fleet by cutting the link on purpose.
A placement optimizer decides where each workload should run, scored by power headroom, transport health and data gravity. A model migrates for real: the target pod loads it on its own runtime before the source lets it go, and every step is governed and audited on the pod where it happens.
Answers from the estate graph with provenance on every fact and a stale flag when data is old. Answers are retrieved, not generated; an optional on-pod model may only rephrase them, and a rephrasing that drops a fact is discarded.
Allocates GPU capacity by role and purpose with a hard cap, so a training job cannot crowd out interactive inference. The grant is the enforcement: a model starts only under a grant made for it, and preempting the grant unloads the model.
Federates ARES™ security findings, HERMES™ detection verdicts, RAMPART™ compensating controls, OT telemetry and a modeled AI-RAN link, read-through and never mutated.
Every governed action is evaluated by a fail-closed governance gate and written to an audit chain each pod signs with its own key. Identity resolves on the server, from the authenticated session or the CAC/PIV certificate and never from the caller’s request, so no caller can assert privilege it does not hold. OSCAL assessment and POA&M exports validate against the NIST models, and every change is tested running the full stack with no route to the internet.
The pod runs itself, under governance, and its peer takes over when it is lost. See Atlas Control™ live on a two-pod reference fleet.