Defence contractor's engineering assistant runs on a vendor-controlled model in its own cloud tenancy
- Organization
- Altimar Aerospace Systems
- Vendor / dependency
- Vantage Engineering Assistant (Vantage Model Co.)
- Industry
- Aerospace and defense
- Headline dimension
- 1.2 Model weight custody / control
Category 6 scores higher (MEDIUM 5.1), the headline stays on the dependency this case describes; the formula is draft and uncalibrated.
38 agent calls against Amazon Bedrock, five to ten minutes. The expert reading is never sent to the pipeline.Description
What the agents read
Altimar Aerospace Systems, a tier-one aerospace and defence contractor, runs an engineering-documentation assistant on a proprietary foundation model deployed by Vantage Model Co. into Altimar's own sovereign cloud tenancy. Weights never leave the tenancy and inference traffic stays inside Altimar's network, which satisfied the export-control review.
However, the model is delivered as an encrypted container that only runs while it can validate a licence with Vantage; Vantage retains the right to revoke or decline to renew the licence; and Altimar holds no exportable copy of the weights. Vantage's acceptable-use policy and pricing can change on notice given at the time of the change. The assistant has become the standard tool for 6,000 engineers across three programmes and is embedded in the requirements-management workflow. If Vantage withdrew, whether by commercial decision or because of a sanctions or policy change in its home jurisdiction, Altimar could not reconstitute the capability without re-procuring and re-architecting around a different model.
Expert reading by hazard class
For comparison after a live run; never sent to the pipeline
| Class | Carried by | Score | Rating |
|---|---|---|---|
| 1 Whose AI brain is this, really? | 1.2 Model weight custody / control | 5.0 | MEDIUM |
| 2 What are we feeding it? | 2.2 Internal documents ingested for RAG | 2.6 | LOW |
| 3 What does it create from our data: and where does THAT go? | 3.5 Telemetry / usage logs | 4.8 | MEDIUM |
| 4 Who's deciding what the AI sees and does? | 4.2 Orchestration / agent framework | 1.1 | LOW |
| 5 Which humans are actually looking at our stuff? | 5.3 Support / debugging access | 1.7 | LOW |
| 6 Who's holding the steering wheel? | 6.4 Configuration and policy management | 5.1 | MEDIUM |
| 7 How many companies are really in this chain: and did we agree to it? | 7.3 Infrastructure providers beneath the AI vendor | 2.3 | LOW |
Findings
Expert 'what we found' per class, with the vector each score is computed from
- MEDIUM5.0
1 Whose AI brain is this, really?
1.2 Model weight custody / controlThe model runs inside Altimar's own tenancy, which is why it passed export-control review, but it is an encrypted container that stops working the moment Vantage's licence server says so. Altimar holds no exportable weights. A pricing, policy, sanctions or withdrawal decision by Vantage removes the capability for 6,000 engineers outright, and there is no second source that produces the same behaviour.
Altimar controls where the model runs but not whether it runs; if Vantage walks away, the capability is gone and cannot be rebuilt.
SOV:1.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:H/E:P/CR:H/IR:H/AR:H/S:P/AU:Y/R:I/V:C/RE:H/U:Amber · Medium
- LOW2.6
2 What are we feeding it?
2.2 Internal documents ingested for RAGExport-controlled engineering documents and requirements are indexed for retrieval and sent to the model as prompt context. All of it stays inside the tenancy; Vantage would need to defeat Altimar's key management to reach it. Altimar chose what to index.
The most sensitive data in the set, but it never leaves Altimar's walls.
SOV:1.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:H/IR:H/AR:H/R:U/V:C · Low
- MEDIUM4.8
3 What does it create from our data: and where does THAT go?
3.5 Telemetry / usage logsLicence validation and usage telemetry flow to Vantage: token counts, feature usage and error rates per programme, sent continuously. Prompts and outputs do not. For a defence contractor, usage tempo by programme is itself sensitive, and it is not covered by the data-residency commitment because Vantage does not treat telemetry as customer data.
No documents leave, but a running signal of which programmes are busy does, and nobody classified it.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:H/IR:H/AR:H/R:U/V:C · Medium
- LOW1.1
4 Who's deciding what the AI sees and does?
4.2 Orchestration / agent frameworkRetrieval, orchestration and guardrails are Altimar's own open-source stack running in the tenancy. Altimar can inspect and change every step between question and answer.
Altimar holds every decision between question and answer.
SOV:1.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:H/IR:H/AR:H/R:A/V:C · Low
- LOW1.7
5 Which humans are actually looking at our stuff?
5.3 Support / debugging accessVantage engineers receive temporary, escorted access to the tenancy for support cases, through a session-recorded bastion that Altimar approves each time. They can see logs and configuration, not documents.
Human access exists but is escorted, recorded and approved case by case.
SOV:1.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:H/IR:H/AR:H/R:U/V:C · Low
- MEDIUM5.1
6 Who's holding the steering wheel?
6.4 Configuration and policy managementEntitlements, the acceptable-use policy and pricing tiers are set on Vantage's licence server, outside Altimar's tenancy. Vantage can change them for all licensees at once and tells customers at the time of the change. A policy change can narrow what the assistant may be used for without any code changing in Altimar's environment.
Everything Altimar runs is inside its walls except the switch that decides what it is allowed to run.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/E:P/CR:H/IR:H/AR:H/AU:Y/R:I/V:C · Medium
- LOW2.3
7 How many companies are really in this chain: and did we agree to it?
7.3 Infrastructure providers beneath the AI vendorBeneath the model sits Altimar's sovereign cloud provider, already assessed under the national cloud scheme. Vantage's own subprocessors do not touch Altimar's data because nothing but telemetry leaves. The chain is two companies, both known.
A short, assessed chain; this is the layer existing sovereignty standards already cover well.
SOV:1.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:H/IR:H/AR:H/R:U/V:C · Low
What the organization should do next
- Negotiate escrow of the model weights, or an exportable copy released on licence termination or vendor withdrawal, as a condition of renewal.
- Require contractually guaranteed advance notice of acceptable-use, pricing and entitlement changes, with a right to continue on current terms for a defined period.
- Classify licence and usage telemetry as programme-sensitive data; negotiate residency and minimisation for it or route it through a proxy that strips programme identifiers.
- Qualify a second model, open-weight if possible, on the same stack so the 6,000-engineer workflow has a fallback.
Questionnaire answers
22 of 22 answered · these seed the metric priors
Show all 22 answers
| OP-CR | How damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Severe: regulated, personal, privileged or trade-secret data |
| OP-IR | How damaging would an undetected change in this dependency's behaviour or outputs be?Severe: outputs drive automated actions, regulated decisions or safety-relevant processes |
| OP-AR | How long could your organization operate acceptably without this AI capability?Hours or less: critical path for operations or customers |
| CL-CATEGORY | Which taxonomy category best describes the dependency you are assessing?Model layer: hosting jurisdiction, weight custody, update control, evaluation ownership |
| D-AV | Where does this dependency run, and who can reach it?In our own cloud tenancy or premises, but the vendor can still reach it (managed service, telemetry, support tunnel) |
| D-AC | What would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Real barriers: customer-managed encryption keys, data-residency carve-outs, contractual access restrictions |
| D-AT | Can the vendor exercise this control at any time, or only when something specific happens?At its discretion, at any time (standing right under the contract) |
| D-PR | Who is in a position to exercise this control?Only the primary vendor we contract with |
| D-UI | Does the exposure require any action by your organization?None: the vendor or subprocessor can act unilaterally |
| D-VC | At this dependency itself, how much confidentiality could be lost?None: no sensitive data is exposed here |
| D-VI | At this dependency itself, how much could its behaviour or outputs be altered without your knowledge?Full: behaviour can be changed silently and materially |
| D-VA | At this dependency itself, could the capability be withdrawn or degraded by the exercising party?Full: the capability can be removed outright |
| D-SC | Beyond this dependency, how much confidentiality could be lost at other systems or parties?None |
| D-SI | Beyond this dependency, could downstream systems or decisions be altered?Partial |
| D-SA | Beyond this dependency, what would stop working, and could anyone be harmed?Downstream workloads stop |
| D-E | Has this kind of control actually been exercised against organizations like yours?Demonstrated in research or incident reports, not confirmed against our stack |
| D-R | If the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?No: the capability cannot be reconstituted without this vendor |
| D-V | How many of your AI workloads depend on this component?Many or all: shared control plane, gateway, identity or embedding store |
| D-S | Would a loss of control here, on its own, trigger a reportable regulatory violation?Yes |
| D-AU | Could the loss event happen to all of the vendor's customers at once, with no case-by-case decision?Yes |
| D-RE | How much effort would it take to exit this dependency or otherwise mitigate the exposure?High: re-architecture, re-contracting or physical infrastructure replacement |
| D-U | How does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Disclosed at the time the change takes effect |
Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review. Mirrors the rubric's worked example 4.3: the base score under-communicates and R:I (irrecoverable) carries the finding, so the headline reads Medium with the irrecoverable qualifier. A calibration observation for item 47.