03 — Governance, Audit & Operations
Governance, Audit & Operations
Chapters 36 – 59 + Appendices — Security model, audit logging, monitoring, testing, productivity measurement, supplier replacement, procurement, continuity, and scaling.
Full Master Architecture PDF
Download PDF
Download the complete NHS Sovereign AI Replacement Architecture master record. The web pages provide section summaries; the PDF contains the full technical architecture.
In This Section
NHS Security Deployment Model
The security model enforces defence-in-depth across all layers:
| Control | Implementation |
|---|---|
| Closed network operation | Air-gapped option available; no external connectivity required |
| No direct transformer access | All model access through NMAI Core only |
| API key authentication | Keys rotated, never hardcoded, stored in environment variables |
| Endpoint restriction | Only approved endpoints exposed through Nginx |
| Data minimisation | Only conditioned input reaches model; raw input never exposed |
| Audit log protection | Append-only JSONL, tamper-evident, access-controlled |
| Model weight protection | Physical and logical access controls on model files |
| Ruleset protection | Change control, versioned, signed updates |
| Plugin security | Local-only, no external network calls |
| Failure-safe behaviour | Fail closed, never fail open to external model |
Security Controls Summary:
- Plugin endpoint control — local API only
- Direct model route blocking at Nginx layer
- Ruleset change control with governance approval
- Network segmentation between containers
- Container isolation and read-only mounts where possible
- Output controls preventing unreviewed content release
- Security testing before every deployment
Audit & Evidence Logging
The audit layer creates tamper-evident evidence for every decision:
| Audit Event | Recorded |
|---|---|
| Minimum audit event | Timestamp, input hash, ruleset version, decision state, audit reference |
| Blocked-state evidence | Full input hash, matched markers, blocking rule reference, user/session ID |
| Warning-state evidence | Caution markers, warning type, user acknowledgment |
| Model-handoff evidence | Conditioned input hash, model name/version, permission state, timestamp |
| Output evidence | Output hash, review status, reviewer ID, acceptance/rejection |
Audit Log Format (JSONL):
{"timestamp": "2026-06-29T10:15:30Z",
"audit_ref": "NMAI-20260629-001015-A7F3",
"ruleset_version": "nhs-rules-v2.3.1",
"input_hash": "sha256:a1b2c3...",
"decision": "permit",
"markers_detected": ["patient_data_boundary", "clinical_risk"],
"model_access": "allowed",
"model_name": "Llama-3.3-70B-Instruct",
"model_version": "v3.3-70B",
"session_id": "sess-7f8a9b"}
Tamper-evident requirements: Append-only logs, checksum chaining, restricted access, integrity monitoring, separate storage from application.
Monitoring Layer
| Monitor | Checks |
|---|---|
| Service health | NMAI API, vLLM, Nginx all responding |
| NMAI monitoring | Conditioning latency, decision throughput, error rate |
| Model endpoint | vLLM queue depth, GPU utilisation, response time |
| Reverse proxy | Request rates, routing errors, blocked direct access attempts |
| Plugin monitoring | Connection success, error rate, user workflow completion |
| Audit integrity | Log continuity, checksum validation, tamper detection |
| Ruleset monitoring | Version compliance, load errors, update status |
| Security events | Blocked access attempts, unusual patterns, escalation triggers |
| Blocked/warning patterns | Trend analysis of blocked inputs, marker frequency |
Testing & Simulation Layer
Test Categories:
| Test Layer | What Is Tested |
|---|---|
| NMAI rules testing | Ruleset loads correctly, all decision states reachable |
| Marker detection | All marker types detected at correct thresholds |
| Blocked input | Blocked inputs never reach model |
| Warning input | Warnings surface correctly, user acknowledgment recorded |
| Permitted input | Permitted tasks route to model with correct conditioning |
| Model handoff | Conditioned package format correct, response handling safe |
| Plugin testing | Document check, blocked state, output integration |
| CUI testing | Workflow states, marker display, review routing |
| Audit testing | Every event logged, tamper evidence working |
| Failure-state testing | Fail-closed behaviour confirmed, no external fallback |
| Simulation testing | Synthetic cases across all decision states |
Simulation Mapping:
- Blocked simulation: NHS numbers, safeguarding, legal terms, clinical risk
- Warning simulation: Urgent clinical wording, ambiguous governance markers
- Review simulation: Complex multi-marker cases requiring human judgment
- Permitted simulation: Generic policy rewrites, meeting summaries, formatting
- Drift resistance: Input variations that should not change decision
- Threshold testing: Boundary cases at marker trigger points
- Ethical alignment: Cases testing NHS ethical principles
Productivity Measurement Replacement
The architecture replaces generic time-saving claims with route-level productivity measurement.
Productivity = (Time Saved) / (Total Route Cost)
Total Route Cost = NMAI conditioning time + model runtime + human review time + correction time + governance overhead
| Measurement | What It Captures |
|---|---|
| Baseline workflow time | Manual task without AI assistance |
| Assisted workflow time | Total time with NMAI-controlled AI |
| Review-time adjustment | Human review burden added by AI output |
| Correction-time adjustment | Time spent fixing AI-generated content |
| Blocked/warning event value | Risk avoided by preventing unsuitable model access |
| Model-handoff rate | What percentage of tasks actually need generation |
| Energy-adjusted productivity | Account for local compute vs. cloud energy |
| Risk-adjusted productivity | Account for sovereignty, audit, safety value |
Pilot Task Table:
- Meeting note summarisation (permitted administrative)
- Policy document restructuring (permitted governance)
- Internal memo drafting (permitted communication)
- Form text plain-English conversion (permitted accessibility)
- Clinical document handling (blocked / review states)
Key Principle
A fast model output is not a productivity gain if it increases review burden, correction burden, or governance risk. The sovereign route must demonstrate lower total cost of ownership including governance, audit, and risk.
Supplier Replacement Matrix
| Existing Dependency | Replacement | Status |
|---|---|---|
| Microsoft 365 Office | LibreOffice + NHS Clinical CUI | Open-source |
| Copilot chat interface | NHS Clinical CUI (controlled workflow) | NHS-built |
| Cloud processing | UK-hosted servers / local trust servers | UK-controlled |
| Model inference | vLLM on UK infrastructure | Open-source |
| Telemetry/logging | NMAI audit trail (JSONL) | NHS-controlled |
| Licensing | Open-source stack, no per-seat licence | Open-source |
| Update control | NHS-controlled update cycle | NHS-governed |
| Supplier continuity | Multi-supplier capable, exit-ready | De-risked |
Procurement Questions for Suppliers:
- Can the component operate without internet connectivity?
- Is the source code inspectable?
- Where is data processed and stored?
- Who controls update timing?
- What is the exit route?
- Is there a per-seat licence dependency?
- Can NHS governance override supplier defaults?
Procurement & Pilot Readiness
| Readiness Area | Evidence Required |
|---|---|
| Architecture readiness | Design documents, API specifications, deployment diagrams |
| Supplier readiness | Due-diligence answers, open-source licences, UK hosting confirmation |
| Data protection | DSPT alignment, DPIA, data minimisation evidence |
| Clinical safety | DTAC alignment, safety case, hazard log |
| Information governance | IG toolkit, Caldicott compliance, records management |
| Security readiness | Cyber essentials plus, penetration testing, vulnerability assessment |
| Testing readiness | Test plan, simulation results, evidence pack |
| Productivity measurement | Baseline metrics, measurement protocol, success criteria |
Procurement Evidence Pack: Architecture overview, technical specification, security assessment, IG assessment, test evidence, pilot protocol, exit plan, support model, scaling route, risk register.
Go / No-Go Decision: Pilot proceeds only when architecture, supplier, data protection, clinical safety, IG, security, testing, and productivity measurement readiness are all confirmed.
Continuity & Exit Architecture
The architecture is designed for graceful exit at every layer:
| Failure Mode | Fallback |
|---|---|
| Model-endpoint failure | Condition-only mode continues; manual workflow available |
| NMAI failure | Fail closed; no model access; manual workflow continues |
| Ruleset failure | Fail closed; use last known good ruleset; alert administrators |
| Audit failure | Fail closed; cannot proceed without audit capability |
| Supplier exit | Open-source components continue; model replaceable |
| Model replacement | Swap model endpoint without redesign; NMAI Core unchanged |
| Hosting replacement | Docker containers portable to new UK infrastructure |
| Office-layer continuity | LibreOffice continues without AI; documents remain accessible |
| Plugin exit | Remove plugin; LibreOffice continues normally |
Fallback Modes:
- Condition-only mode: NMAI conditioning works, generation disabled
- Manual review mode: All tasks routed to human review
- Full stop mode: Emergency stop engaged, all AI disabled
NHS Retained Control
| Control Area | NHS Authority |
|---|---|
| Patient-data boundary | NHS defines, enforces, and audits what data may enter the AI route |
| Rulesets | NHS creates, approves, and updates all marker and decision rules |
| Input conditioning | NMAI Core is NHS-controlled; supplier cannot alter conditioning logic |
| Model access | NHS decides which tasks may reach a model |
| Model selection | NHS approves model, version, and capability envelope |
| Audit logs | NHS owns all audit data; supplier has no access |
| Output status | NHS reviews, approves, or rejects every model output |
| Plugin configuration | NHS controls plugin settings and deployment |
| Supplier access | NHS controls what suppliers can access, update, or modify |
| Monitoring | NHS monitors system health, security, and compliance |
| Updates | NHS controls timing and approval of all updates |
| Emergency stop | NHS can stop all AI generation at any time |
| Exit | NHS can exit the architecture without supplier dependency |
DSPT Alignment Mapping
The architecture is mapped against NHS Data Security and Protection Toolkit standards:
| DSPT Requirement | Architecture Evidence |
|---|---|
| Data minimisation | Only conditioned input reaches model; raw input never exposed |
| Patient-data boundary | Marker detection blocks patient data; audit records every boundary check |
| Access control | API keys, endpoint restriction, Nginx controls |
| Ruleset governance | NHS-approved rules, versioned, change-controlled |
| Audit trail | Append-only JSONL, tamper-evident, audit reference per transaction |
| Incident response | Emergency stop, fail-closed, cyber incident evidence |
| Supplier management | Open-source stack, exit-ready, continuity architecture |
Emergency Stop & Cyber Incident Alignment
| Trigger | Action |
|---|---|
| Fail-closed principle | Any control failure stops model access; never falls back to external model |
| Emergency stop triggers | Security incident, ruleset breach, model compromise, IG alert, cyber attack |
| Condition-only mode | NMAI continues conditioning and audit; generation disabled |
| Manual review mode | All tasks routed to human specialists |
| Restart evidence | Full audit of stop event, restart authorization, system checks |
| Cyber incident evidence | Logs preserved, incident reference created, forensic trail maintained |
Deployment Scaling Route
| Stage | Scope | Criteria |
|---|---|---|
| 1. Local prototype | Single developer machine | NMAI conditions, ruleset works, audit logs, safe failure |
| 2. Department pilot | Single department, synthetic data | Bounded workflow tasks, non-identifying data, governance oversight |
| 3. Trust pilot | Single NHS Trust | Operational deployment, IG approval, cyber review, clinical safety sign-off |
| 4. Regional deployment | Multiple trusts, ICS level | Interoperability, shared rulesets, regional audit, scaling evidence |
| 5. National deployment | NHS-wide | Full evidence, governance, cyber, procurement, exit controls all approved |
Final Architecture Position
Core Position
NMAI Core governs access. The model executes only after permission. The model is replaceable. The route is sovereign.
| Component | Position |
|---|---|
| NMAI Core | Deterministic input-conditioning kernel; pre-transformer control authority |
| Transformer | Post-conditioning execution module; drafts only after permission |
| Open-source office | Document control layer; NHS retains document sovereignty |
| NHS Clinical CUI | Controlled workflow interface; not a chatbot |
| UK compute layer | UK-hosted only; patient data never leaves UK jurisdiction |
| Audit | Tamper-evident evidence for every decision; NHS-owned |
| Procurement | Open-source, exit-ready, evidence-based, no supplier lock-in |
| Productivity | Route-level measurement including governance, audit, and risk value |
| Continuity | Graceful exit at every layer; fail-closed; emergency stop available |
NMAI Core first. Audit before model handoff. Model only where permitted. Output always reviewable. No external fallback. No direct model access. No NMAI Core decision, no model call.