The Factory Behind the Factory

Paper 11 says three things this domain must answer. The enterprise token ceilings of 25 to 50 million tokens per minute will likely be exceeded soon. A sovereign compute prequalification is in market, with exclusive GoA control of health and security data as a non-negotiable position. And Red Hat OpenShift is under evaluation for the Ministry's own hardware. Cisco's answer is the Secure AI Factory with NVIDIA: the same reference design at any scale, with the sovereignty question answered by geography instead of compromise.

From order to intelligence, on a clock

Cisco Services runs the deployment on two named metrics. Time to first intelligence (TTFI) covers plan, design, implement, validate, knowledge transfer, optimize, and scale-out, with up to a 75 percent reduction in deployment time, three to four weeks in practice. Cost to true scale (CTTS) makes the expansion curve predictable. The reference cases: a 1,000+ GPU cluster validated in under a week, and a global travel platform that hit cost break-even after ten training runs.

Which reference architecture, at which scale

Cisco internal technical documentation names sovereign clouds as a segment the CRA is built for. Alberta would enter at ERA scale with a CRA-compatible design, so the ceiling is 32,000 GPUs away.

What a 32-GPU scaling unit delivers

The smallest building block of the factory, sized against models Alberta already tests. Pick the GPU; figures are tokens per second and concurrent users for one 32-GPU unit.

Estimates from Cisco internal technical documentation; production varies with implementation. Public benchmarks: mlcommons.org.

The compute range, core to edge

One Intersight fleet manages all of it, one support contract stands behind the whole stack, and the network underneath carries outcomes Cisco documents by name: AI fabric templates and congestion scoring in Nexus Dashboard, intelligent packet flow with advanced load balancing, and lossless RoCEv2 from 10G to 800G. Ministry sites outside Edmonton get the same architecture at edge scale, which is how 27 ministries stay one estate.

Paper 11 puts the number on the problem: the best models resist prompt injection 95 to 98 percent of the time, and no model is immune. Paper 07 adds that skill files are software and can carry an attack. Paper 02 reports exploits weaponized in hours. Nexus already re-delegates agent access every few hours so that no grant is permanent. This domain covers the remaining distance: inline enforcement on every prompt and response, scanning of the components agents mount, and governance ready before the claws arrive.

The 200+ checks, unpacked

Validation produces reports mapped to OWASP, NIST, and MITRE, then generates guardrails aimed at the specific weaknesses it found in the specific model under test. The guardrails run bi-directionally at runtime, and the same policy applies whether the model sits in Bedrock or on Alberta's own GPUs, because enforcement is hybrid: control and management stay in Security Cloud Control while runtime traffic never leaves the premises. Where NVIDIA NeMo Guardrails already run, AI Defense supplies the input and output rails through API disposition and shares one policy across both. One boundary belongs in the proof of value rather than in prose: runtime payloads stay on premises, while policies, events, and reports flow to the Security Cloud Control plane, and whether that management envelope meets Protected B handling, and what a fully offline Protected C posture looks like, are questions the PoV answers with evidence.

The public scoreboard

Validation is only credible if the results are published, so they are. The AI Defense leaderboard ranks frontier and open models against the same red-teaming suite this document proposes running against Alberta's fleet. The models in Alberta's stack are on it.

Sized like everything else in the factory

The Large configuration covers one rationalized ministry (16 modules) three times over. Source: Cisco internal technical documentation and the Design Zone reference architecture.

Policy Studio: legislation in, guardrails out

Paper 05 rests Government 3.0 on one premise: business rules written once, drawn straight from legislation and policy, so that when the law changes, every interaction follows the new rule the same day. Policy Studio is that premise applied to guardrails. A policy owner, a compliance officer rather than an engineer, works through a chat-and-review session: the assistant drafts a human-readable policy document, tests it against real conversations, and surfaces the judgment calls as questions. Textual insights flag gaps in the draft ("does hypothetical phrasing count as advice?"); behavioural insights show patterns from production data, thirty-one cases at a time, answerable with one decision. Ten distinct judgments cost about ten answers, whether the corpus is seventy conversations or seventy thousand.

The result is one artifact doing three jobs: compliance reads it, auditors read it, and the runtime classifier reads it to decide every request. The published research behind it shows a reasonably sized open-source model interprets such a policy almost as accurately as a frontier model, so the rule Alberta's policy owner writes can run on Alberta's own hardware, no hosted API in the loop. For a government whose regulatory content is already codified law, this is the shortest path from statute to enforcement anyone has shipped. It is also a working answer to the genie problem: the constitutions behind it run three hundred lines per technique, precise enough that different frontier models return the same decision on the same input, which is what taking the latitude out of language looks like in practice.

Runtime enforcement at the kernel, in five lines of YAML

Paper 09's sandbox is Nexus policy; Isovalent enforces the same intent one layer down, in the kernel, where an agent cannot argue with it. Each example below is a working policy from the Cisco reference materials. This is what "the floor is load-bearing" means in practice, and it is the enforcement layer waiting for the claw phase.

kind: CiliumNetworkPolicy
metadata: { name: "agent-rule" }
spec:
  endpointSelector: { matchLabels: { role: agent } }
  ingress:
  - fromEndpoints:
    - matchLabels: { role: frontend }   # allow, everything else drops

egress:
- toFQDNs:
  - matchName: "*.aidefense.security.cisco.com"
  toPorts: [ { ports: [ { port: "443", protocol: TCP } ] } ]

kind: SandboxPolicyNamespaced
spec:
  syscalls:
  - list: [ sys_ptrace, sys_execve, sys_chmod, sys_mount ]
    actions: [ Post, Block ]   # log it, then refuse it

kind: TracingPolicy
spec:
  file_paths: [ "/models/llama.safetensors" ]
  matchOperations: [ FILE_WRITE, FILE_DELETE ]

Take the code, today

Alberta published its work under MIT and asked industry to answer in kind. Every scanner and governance tool named in this domain is public, and adopting any of them requires nothing from Cisco.

A worked example the papers will recognize

The Secure AI Factory materials close with a secured document-processing assistant: OCR extraction, embedding, a vector database, retrieval, and an LLM, each stage carrying its control. Validation red-teams the model and informs the policy; guardrails police query and response; the runtime agent blocks a sys_mount from inside the embedding pod; the container network polices inter-service traffic at layer 7; confidential computing encrypts execution; the perimeter brokers access. Swap the sample documents for paper 11's fourteen million historical records and this is the 250-agent job, secured end to end with parts that exist.

Nexus already treats permanence as the enemy: access is re-delegated every few hours, so nothing an agent holds lasts. Paper 11 names the next step, agentic identity management, as something Alberta is taking to industry. Duo Agentic Identity is Cisco's answer, and it works the way Nexus already thinks. Every non-human identity is discovered, including the ones nobody registered. Authorization is task-based and time-boxed: an agent gets what this job needs, for as long as this job runs. And the agent acts in its own name, so the audit trail reads "the remediation agent did this at 03:00," with a named human accountable behind it, which is the exact condition paper 05 sets for Government 3.0. Because it lives inside Duo alongside Identity Intelligence, the human and non-human sides of the ledger share one lifecycle: agents are onboarded, enabled, and offboarded with named human oversight, the same way staff are.

Paper 15 argues that human oversight must move from the individual agent to the level of the system, because no reviewer can read the token streams of a thousand workers. Nexus solved the technical half: administrators can audit every agent on every machine, and Alberta built agents to audit the agents. The open question is the layer above, where activity from hundreds of environments becomes risk scores, patterns, and automatic containment, visible to people who never open a terminal.

Government 3.0 ends with agents operating the estate, every action observable and accountable to a named person (paper 05). Cisco runs its own version of that model today: Cloud Control is the unified operations platform for the agentic era, one login, one inventory, one live topology, with three agentic surfaces on top. AI Canvas is a multiplayer workspace where operators and agents resolve issues together, governed by organizational policy with auditability at each step. AI Assistant answers in plain language across domains. Cloud Control Studio connects third-party tools and builds custom agents grounded in the organization's own context, which is where Nexus, Ent Tools, and the Velocity game engine would plug in. Cloud Control and AI Canvas are included with existing Cisco subscriptions at no additional cost, which matters for a ministry at 1.4 percent IT spend.

The operational claims are specific, and each one lands on a sentence in the papers. A cross-domain fault, one user's device through access point, controller, and firewall to a VPN tunnel missing a route, resolves from a single natural-language question to a one-click remediation in minutes, and the whole sequence can be handed to an agent as trust accrues. That is paper 15's oversight gradient, moving from approval to delegation, implemented in a product. Security policy is written in natural language and enforced as mesh policy across every control point, which is paper 05's rules-as-code principle applied to infrastructure. Agent-level spend is a first-class metric: an agent that has quietly consumed $24,000 in tokens is a line on a screen with its full activity trace one click away, which is the runaway-token control paper 11 builds budgets for. Underneath sit purpose-built models for network, security, and time-series data rather than one general model for everything, the same purpose-built-over-frontier pattern Alberta applies to its own stack. Cloud Control is generally available in the United States, 52 partners publish into its marketplace, and Cloud Control Studio embeds Codex so a custom application or agent, the kind Alberta's Builders produce in Nexus, takes a prompt and minutes.

On the partnership itself, paper 11 commits Alberta to inviting strong companies to test tools against government workloads through the Sovereign Compute process and forthcoming requests for proposals. Cisco's position: the proof-of-value components ride whichever vehicle the Ministry prefers, the R&D relationship with Amii and the University of Alberta continues on its own track, and anything Cisco cannot cover gets named in the room so the Ministry can source it elsewhere. The scorecard below has open cells on purpose.