The Factory Behind the Factory

This domain is about scalable inference and target-architecture provisioning, engineering questions squarely suited to Cisco support. The target is a tenfold climb, from about 3 to 30 billion tokens a day, feeding approximately 12,000 application-garage agents plus thousands of security and accessibility evaluators across hundreds of applications, thousands of screens, and tens of thousands of APIs and data objects. Alberta owns the recursive loop and orchestrator; Cisco helps integrate with that orchestrator and plan the capacity beneath it: concurrency, expert-model range, tokens, latency, GPU utilization, network and storage, virtual environments, failure domains, observability, provisioning, and scale-out stages that avoid a forklift rebuild. Paper 12 adds context: the enterprise token ceilings of 25 to 50 million tokens per minute will likely be exceeded soon, controlled compute is being pursued for scale and operational control, and Red Hat OpenShift is under evaluation for the Ministry's own hardware. Target AI workload: unclassified code and schemas; no personal information is processed by the target AI. controlled compute here is justified by scale, economics, resilience, policy, and model choice, not by any personal or health data. Cisco's contribution is the Secure AI Factory with NVIDIA: the same reference design at any scale.

Detailed sizing, throughput, GPU, user, power, cost, and deployment-time figures in this section are illustrative engineering estimates from Cisco internal technical documentation, not sizing or delivery commitments. Results depend on model, precision, context, batching, concurrency, software release, workload mix, infrastructure, and site conditions. Availability, licensing, release status, regional availability, required subscriptions, and configuration must be confirmed before procurement scope.

From order to intelligence, on a clock

Cisco Services runs the deployment on two named metrics. Time to first intelligence (TTFI) covers plan, design, implement, validate, knowledge transfer, optimize, and scale-out, with up to a 75 percent reduction in deployment time, three to four weeks in practice. Cost to true scale (CTTS) makes the expansion curve predictable. The reference cases: a 1,000+ GPU cluster validated in under a week, and a global travel platform that hit cost break-even after ten training runs.

The 1,000+ GPU and travel-platform examples are illustrative internal reference cases, not delivery, sizing, cost, or performance commitments. Results depend on model, precision, context, batching, concurrency, software release, workload mix, infrastructure, and site conditions; see also §10.

Which reference architecture, at which scale

Cisco internal technical documentation names sovereign clouds as a segment the CRA is built for. Alberta would enter at ERA scale with a CRA-compatible design, so the ceiling is 32,000 GPUs away.

What one GPU scales into

Alberta can start at a single GPU and scale up from there, sized against models Alberta already tests. Pick the GPU; figures below are tokens per second and concurrent users for a validated 32-GPU reference unit, the standard building block once a deployment scales past a single card.

Illustrative engineering estimates from Cisco internal technical documentation, not sizing commitments. Results depend on model, precision, context, batching, concurrency, software release, workload mix, and implementation. Public benchmarks: mlcommons.org.

The compute range, core to edge

Intersight is a candidate management layer for supported configurations. Support boundaries and contracts must be agreed in commercial scope. The network underneath can provide and the network underneath carries outcomes Cisco documents by name: AI fabric templates and congestion scoring in Nexus Dashboard, intelligent packet flow with advanced load balancing, and lossless RoCEv2 from 10G to 800G. Ministry sites outside Edmonton get the same architecture at edge scale, which is how 27 ministries stay one estate.

Compute-range specifications and the Nexus Dashboard feature list are drawn from Cisco internal technical documentation.

Paper 12 puts the number on the problem: the best models resist prompt injection 95 to 98 percent of the time, and no model is immune. Paper 07 adds that skill files are software and can carry an attack. Paper 02 reports exploits weaponized in hours. Nexus already re-delegates agent access every few hours so that no grant is permanent. This domain covers the remaining distance: inline enforcement on every prompt and response, scanning of the components agents mount, and governance ready before the claws arrive.

None of this is provable from a slide. Before Alberta commits to R4 through R7 at scale, Domain B proposes a proof of value that needs nothing invented: take the same six control areas FIG. 2b already marks as a baseline, and run the matching Cisco capability against each one, so every row of the table below produces its own measured number instead of a vendor claim. Paper 09's claw-based orchestration expansion, where white-hat claws already simulate real attackers against real self-directed agents, is one candidate rollout to carry the test. The actual use case and the timeline are both still to be determined.

Examples from 200+ attack techniques and threat categories

These examples illustrate the published set of 200+ attack techniques and threat categories.

Validation produces reports mapped to OWASP, NIST, and MITRE, then generates guardrails aimed at the specific weaknesses it found in the specific model under test. The guardrails run bi-directionally at runtime, and the same policy applies whether the model is hosted elsewhere or running on Alberta's own GPUs, because enforcement is hybrid: control and management stay in Security Cloud Control while runtime traffic never leaves the premises. Where NVIDIA NeMo Guardrails already run, AI Defense supplies the input and output rails through API disposition and shares one policy across both. One boundary belongs in the proof of value rather than in prose: runtime payloads stay on premises, while policies, events, and reports flow to the Security Cloud Control plane, and whether that management envelope meets Protected B handling, and what a fully offline Protected C posture looks like, are questions the PoV answers with evidence.

Integration details with NVIDIA NeMo Guardrails and Security Cloud Control are drawn from Cisco internal technical documentation.

The public scoreboard

Validation is only credible if the results are published, so they are. The AI Defense leaderboard ranks frontier and open models against the same red-teaming suite this document proposes running against Alberta's fleet. The models in Alberta's stack are on it.

Sized like everything else in the factory

Illustrative engineering estimates, not sizing commitments. Actual results depend on model, precision, context, batching, concurrency, software release, workload mix, and configuration. Source: Cisco internal technical documentation and the Design Zone reference architecture.

Policy Studio: legislation in, guardrails out

Paper 05 rests Government 3.0 on one premise: business rules written once, drawn straight from legislation and policy, so that when the law changes, every interaction follows the new rule the same day. Policy Studio is that premise applied to guardrails. A policy owner, a compliance officer rather than an engineer, works through a chat-and-review session: the assistant drafts a human-readable policy document, tests it against real conversations, and surfaces the judgment calls as questions. Textual insights flag gaps in the draft ("does hypothetical phrasing count as advice?"); behavioural insights show patterns from production data, thirty-one cases at a time, answerable with one decision. Ten distinct judgments cost about ten answers, whether the corpus is seventy conversations or seventy thousand.

The result is one artifact doing three jobs: compliance reads it, auditors read it, and the runtime classifier reads it to decide every request. The forthcoming research behind it shows a reasonably sized open-source model interprets such a policy almost as accurately as a frontier model, so the rule Alberta's policy owner writes can run on Alberta's own hardware, no hosted API in the loop. For a government whose regulatory content is already codified law, this is the shortest path from statute to enforcement anyone has shipped. It is also a working answer to the genie problem: the constitutions behind it run three hundred lines per technique, precise enough that different frontier models return the same decision on the same input, which is what taking the latitude out of language looks like in practice.

Runtime enforcement at the kernel, in five lines of YAML

Paper 09's sandbox is Nexus policy; Isovalent enforces the same intent one layer down, in the kernel, where an agent cannot argue with it. Each example below is a working policy from the Cisco reference materials. This is what "the floor is load-bearing" means in practice, and it is the enforcement layer waiting for the claw phase.

kind: CiliumNetworkPolicy
metadata: { name: "agent-rule" }
spec:
  endpointSelector: { matchLabels: { role: agent } }
  ingress:
  - fromEndpoints:
    - matchLabels: { role: frontend }   # allow, everything else drops

egress:
- toFQDNs:
  - matchName: "*.aidefense.security.cisco.com"
  toPorts: [ { ports: [ { port: "443", protocol: TCP } ] } ]

kind: SandboxPolicyNamespaced
spec:
  syscalls:
  - list: [ sys_ptrace, sys_execve, sys_chmod, sys_chown ]
    actions: [ Post, Block ]   # log it, then refuse it

kind: TracingPolicy
spec:
  file_paths: [ "/models/llama.safetensors" ]
  matchOperations: [ FILE_WRITE, FILE_DELETE ]

Take the code, today

Alberta published its work under MIT and asked industry to answer in kind. Every scanner and governance tool named in this domain is public, and adopting any of them requires nothing from Cisco.

A worked example the papers will recognize

OCR extraction, embedding, a vector database, retrieval, and an LLM, each stage carrying its control. Validation red-teams the model and informs the policy; guardrails police query and response; the runtime agent blocks a sys_mount from inside the embedding pod; the container network polices inter-service traffic at layer 7; confidential computing encrypts execution; the perimeter brokers access. Swap the sample documents for paper 12's fourteen million historical records and this is the 250-agent job, secured end to end with parts that exist.

Antares: open-weight models sized for the scan, not the chat

Cisco Foundation AI has released the open-weight Antares-350M and Antares-1B models on Hugging Face; Antares-3B is coming soon. On Cisco's 500-task Vulnerability Localization Benchmark and among the released models, Antares does a job neither scanner does today: given a known vulnerability, it works iteratively through a codebase like an investigator, reading files and backtracking on evidence, to rank which files actually contain it. That closes the gap between rule-heavy static analysis and general coding models not tuned for security triage, sitting upstream of what the Skill Scanner and MCP Scanner already cover. On Cisco's 500-task Vulnerability Localization Benchmark, Cisco's chart estimates about $0.82 for the compared released Antares run versus $141 for the plotted GPT-5.5 run, approximately 172× lower. This is a benchmark estimate, not a production guarantee. That locality matters for R1 and R4 both: nothing about a scan needs to leave Alberta's own facilities.

Nexus re-delegates access every few hours. Duo Agentic Identity is a candidate identity control to test for discovery, human ownership, scoped authorization, lifecycle, and audit. Integration with Alberta's delegation model, direct mapping to Nexus, availability, licensing, regional availability, required subscriptions and configuration, and orderability must be validated before procurement scope.

Duo Agentic Identity builds on Astrix Security's non-human identity discovery technology; Cisco completed the acquisition in June 2026.

Paper 15 argues that oversight must move from individual agents to the system level. Splunk can provide workflow traces, evaluations, token, cost, and performance data where instrumentation exists. Cross-product correlation, automation, evaluator ingestion, and containment require integration validation. Agent Observability does not replace Alberta's evaluator logic or provide containment by itself.

The Splunk Enterprise Security + AI Defense add-on integration and the containment-playbook capability are drawn from Cisco internal technical documentation; the evaluators, tokenomics, and guardrail features below are documented publicly by Splunk.

Government 3.0 anticipates agents helping operate the estate with observable, accountable actions. Cloud Control manages supported Cisco infrastructure only. AI Canvas, AI Assistant, and Studio are candidate capabilities to evaluate. Potential integration with Alberta systems is an architecture hypothesis, not an established integration surface or orchestrator. Alberta's application garage, SDLC, content engine, and orchestration remain Alberta's. Availability, licensing, release status, regional availability, required subscriptions and configuration, and Studio pricing must be confirmed with Cisco before procurement scope.

Optional web evidence follows. It is not required for the presentation or working session.

Cloud Control may provide an operational view of supported Cisco infrastructure. Whether its supported inventory, topology, policy, assistant functions, AI Canvas, or Studio can participate in Alberta workflows must be tested. It is not Alberta's integration surface or orchestrator. Studio pricing and status must be confirmed.

On the partnership itself, paper 12 commits Alberta to inviting strong companies to test tools against government workloads through the Sovereign Compute process and forthcoming requests for proposals. Cisco's position: the proof-of-value components ride whichever vehicle the Ministry prefers, the R&D relationship with Amii and the University of Alberta continues on its own track, and anything Cisco cannot cover gets named in the room so the Ministry can source it elsewhere. The scorecard below has open cells on purpose.