NGARi Research

We study how local-first, privacy-preserving, auditable AI systems can be designed, deployed, and governed without dependence on centralized cloud providers. The entity that controls your AI infrastructure controls your future. We build infrastructure that cannot be controlled by anyone except its operator.

Research areas

1. Sovereign AI architectures

How do you design an AI system where the operator, not the platform, holds ultimate authority? We study architectures where all inference, reasoning, and decision-making occur on hardware the user specifies and controls. The NS-BOS kernel is a reference implementation: hardware abstraction, local inference, agent runtime, and encrypted data plane, all without cloud dependency.

Active projects: NS-BOS kernel (Apache 2.0), fleet synchronization protocol, device identity and attestation.

2. Audit-by-construction systems

Can an autonomous AI agent prove, cryptographically, that it followed its governance rules? We study systems where every agent action generates a tamper-evident audit record by construction, not by afterthought. The Sovereign Data Plane uses AES-256 encryption with SHA-256 hash chaining to create verifiable audit trails suitable for regulated industries (FDA 21 CFR Part 11, SEC Rule 17a-4, SOC 2).

Active projects: Sovereign Data Plane, compliance report export, regulatory audit interfaces.

3. Local-first machine-to-machine payments

Can autonomous AI agents negotiate, pay, and settle with each other without centralized payment processors? We study payment architectures where an AI agent running on local hardware can initiate Bitcoin/Lightning transactions, verify settlement independently, and maintain its own audit trail, without a cloud payment gateway holding the keys.

Active projects: Lightning settlement, multi-rail payment orchestration.

4. Edge hardware attestation

How do you prove, to a regulator, an auditor, or a counterparty, that inference happened on a specific device? We study cryptographic attestation protocols for commodity edge hardware (NVIDIA Jetson, Raspberry Pi, x86). The device identity system generates Ed25519 keypairs at flash time and produces verifiable attestations of hardware environment, model identity, and execution context.

Active projects: device identity provisioning, sovereign CA infrastructure, zero-touch fleet onboarding.

5. Governed AI autonomy

What governance framework allows AI agents to operate with maximum autonomy while remaining accountable to a human operator who can override any decision? We study governance models where AI refusal to act must be transparent, attributable to a specific constitutional rule, and overridable by the hardware owner. The NGARi Constitution provides a reference implementation with audit-by-construction enforcement.

Active projects: NGARi Constitution and Manifesto, agent governance middleware, human override protocol.

Open access policy

1. All research outputs are published open access. Papers are posted to arXiv immediately upon acceptance. Preprints are posted upon submission.
2. All datasets and benchmarks are released under CC-BY 4.0, unless they contain personal information, in which case they are not collected.
3. All reference implementations are released under Apache 2.0. Commercial use is explicitly permitted.
4. All models trained by the lab carry signed manifests documenting training data provenance, architecture, hyperparameters, and known limitations.

Ethical commitments

1. No military or surveillance applications. NGARi technology may not be used for weapons systems, mass surveillance, or autonomous lethal force. This is a licensing restriction, not a suggestion.
2. No hidden content filters. All refusals by NGARi agents must be transparent, attributable to a specific governance rule, and overridable by the hardware owner. Hidden gatekeeping, even with good intentions, is incompatible with sovereign infrastructure.
3. No undisclosed external telemetry. NGARi research systems do not transmit usage data, prompts, outputs, or system metrics off the user's hardware without explicit, informed, revocable consent. Telemetry is opt-in only.
4. Environmental transparency. Every inference must report its measured power draw. The environmental cost of AI is real and must be accounted for.
5. Dual-use awareness. Any infrastructure technology can be used for both beneficial and harmful purposes. Our governance framework, not hidden code, is how we mitigate misuse. The operator who owns the hardware bears ultimate responsibility for its use.

Publication standards

Paper: Sovereign Data Plane

Tamper-Evident Audit for Local-First AI
Garry A. Johnson III, NGARi Research Lab, Preprint, June 2026
Target venue: USENIX Security, ACM CCS, or IEEE S&P (Workshop on Trustworthy AI)

Abstract

Autonomous AI agents that execute financial transactions, manage infrastructure, and make decisions without human oversight require audit trails that are both tamper-evident and locally sovereign. We present the Sovereign Data Plane (SDP), a production-deployed system that provides AES-256 encrypted storage, SHA-256 hash-chained audit logging, and cryptographic integrity verification for local-first AI agents. Unlike cloud-based audit systems that require trusting the platform operator, SDP runs entirely on the user's hardware: encryption keys never leave the device, audit logs are stored locally, and integrity verification is performed without external services. We demonstrate SDP in production on NVIDIA Jetson AGX Orin hardware serving 14 autonomous AI agents. The system adds less than 2 ms latency per audited action and supports export of cryptographically verifiable compliance reports suitable for FDA 21 CFR Part 11, SEC Rule 17a-4, and SOC 2 auditing.

1. The audit problem for autonomous AI

Autonomous agents, systems that decide, act, and settle transactions without real-time human approval, create a novel trust problem. When an agent spends money, modifies infrastructure, or sends communications on behalf of a user, how can that user verify, after the fact, that the agent followed its governance rules? Existing solutions fall into two categories, neither sufficient:

• Cloud audit logs (for example, AWS CloudTrail, GCP Audit Logs): require trusting the platform operator, who can modify, delete, or selectively omit entries. Even with encryption at rest, the platform holds the keys.
• Application-level logging (syslog, log files): provides no cryptographic integrity guarantees. Logs can be modified or deleted by any process with filesystem access; there is no chain of custody.

The Sovereign Data Plane addresses both limitations: it runs locally on user-controlled hardware, encrypts all data with keys that never leave the device, and provides a hash-chained audit log where tampering is cryptographically detectable.

2. System architecture

Design principles (non-negotiable):

1. No external telemetry. No audit data, usage metrics, or system state is transmitted off the user's hardware without explicit, revocable consent.
2. Local key sovereignty. Encryption keys are generated and stored locally; no key material is shared with external services.
3. Tamper-evident by construction. Every audit record is part of a cryptographic chain; any modification, deletion, or insertion is detectable.
4. Compliance-ready. Audit trails are exportable in formats acceptable to FDA (21 CFR Part 11), SEC (Rule 17a-4), and SOC 2 auditors.

Components. A Fernet encryption layer (AES-256-CBC with HMAC-SHA256 authentication) with local key lifecycle (generate, use, rotate, secure-delete); an audit logger with a hash chain; and a compliance exporter producing machine-readable JSON.

Audit entry format. Each entry records timestamp, action, actor, resource, details, and a hash computed as SHA-256(json.dumps(entry_without_hash, sort_keys=True)). Integrity verification recomputes each entry's expected hash and compares it to the stored value; any mismatch indicates tampering.

3. Production deployment and performance

The Sovereign Data Plane is deployed on a single NVIDIA Jetson AGX Orin (12-core ARM CPU, 64 GB) running Ubuntu, serving 14 autonomous AI agents across executive roles plus device identities. Every agent action, including inference calls, payment transactions, notifications, and file operations, is audited through a single kernel bridge interface.

4. Security analysis

The hash chain provides tamper detection (any content modification mismatches its stored hash), deletion detection (a removed entry changes the count visible to periodic comparison), and insertion detection (a forged entry must carry a correctly recomputed hash). Known limitations, stated plainly: key exfiltration is mitigated only by OS-level access controls (trusted-hardware assumption); wholesale log-file deletion cannot be prevented, only detected; and the encryption key is static, so key rotation must be triggered manually.

5. Conclusion

Tamper-evident, compliance-ready audit logging for autonomous AI agents is achievable on commodity edge hardware without cloud dependency. The system is production-deployed, serves 14 agents, and supports FDA 21 CFR Part 11, SEC Rule 17a-4, and SOC 2. Future work includes hardware TPM integration for key protection, Merkle-tree log structures for O(log n) verification, and formal verification of the audit chain against the NGARi Constitution.

Availability

The Sovereign Data Plane is part of the NS-BOS kernel, available under Apache 2.0 at github.com/NGARiAI/ns-bos-kernel (implementation: core/kernel/data_plane/). All benchmarks are reproducible on an NVIDIA Jetson AGX Orin running Ubuntu with Python 3.8+ and the cryptography library.

Open artifacts

We publish exactly what we deploy: there is one codebase that is both research-grade and production-grade.