Ri Koh — AI Sovereignty in One Page
The same Claude AI. Three different infrastructure paths. Picked per query.
The three paths
| Anthropic API | AWS Bedrock | Local LM Studio | |
|---|---|---|---|
| Tier label | Default | Sovereignty | Air-gap |
| Status today | Enabled | Built, not yet enabled | Built, not yet enabled |
| Where inference runs | Anthropic-managed AWS | Customer-pinned AWS region (us-east-1, us-gov-west-1) |
On-premise, customer hardware |
| Region pinning | US (not customer-pinnable on standard tier) | Yes — single AWS region per tenant | Yes — never leaves the network |
| Train opt-out | YES — Anthropic Commercial Terms | YES — AWS Bedrock service terms | YES — model is local |
| Compliance attestations | SOC 2 Type II · ISO 27001 · ISO 42001 | SOC 2 Type II · FedRAMP High (GovCloud) · HIPAA-eligible | Inherits customer's controls |
| Latency | Fastest | Fast (one extra AWS hop) | Slowest (consumer GPU) |
| Answer quality | Best (full Claude Sonnet) | Best — same Claude weights via AWS | Good for facts; weaker on persona/voice |
Anthropic and Bedrock both run identical Claude weights — choosing Bedrock does not degrade answer quality, only changes the contractual perimeter around the inference. The Local path runs an open-weights model (Llama, Qwen, Mistral) on customer hardware.
How the routing decision is made
For every query, Ri Koh picks one provider using the following precedence (top wins):
- Sensitivity override (chat). If any retrieved RAG chunk carries
sensitivity_level='restricted', the chat answer is routed to Local and tagged with a red SOVEREIGNTY FORCED badge. If Local is not available, the question is refused and nothing is sent to any AI provider; a failed classification lookup counts as restricted. Current limits: it covers chat answers only, not document ingestion or other features, and files attached directly in chat are not classified. - Per-query manual override. The chat composer exposes a provider dropdown and a 🔒 Sovereign toggle. The dropdown picks a provider for the next single query. The 🔒 toggle pins all subsequent queries to Local until cleared. While the Local tier is not enabled, the toggle is greyed out, and a request for Local is refused rather than sent to another provider.
- Tenant default. Each tenant can be configured with a default provider (e.g., a GovCloud-only customer can default to Bedrock).
- Worker default. Falls through to the
DEFAULT_AI_PROVIDERenvironment variable (currentlyanthropic).
Every response carries a Generated by X badge that names the provider, the model, and (for Bedrock) the region. The model and token usage are recorded in the tenant's AI usage log; the provider itself is not yet persisted per query.
What gets sent to each provider
The request shape is identical across all three: the assembled system prompt, the retrieved RAG context, the user's question, and a bounded conversation history (max 10 turns). No identity tokens, JWTs, or cross-tenant data are ever sent to a provider — the post-retrieval context is filtered to the requesting user's access scope before the provider call is made. Switching provider does not change what is or isn't visible to the model; it only changes which legal entity and which physical infrastructure runs the inference. Outside chat, document ingestion (knowledge extraction, scanned-PDF OCR) and features such as proposals, compliance extraction, and artifacts call the Anthropic tier directly; they do not go through this routing.
When to use which
Anthropic (default)
Obvious choice for general commercial use. Best latency, best quality, simplest billing. Default for every tenant unless an enterprise agreement specifies otherwise.
AWS Bedrock
Pick this when the customer needs an explicit US-region commitment, FedRAMP coverage, or wants the inference covered under their existing AWS BAA / DPA / GovCloud contract. Same Claude quality as the default path.
Local (LM Studio)
Pick this when the data fundamentally cannot leave the customer's network. Use it for restricted-sensitivity content (CUI, HIPAA, attorney-client privileged), air-gapped facilities, and full air-gap demonstrations.