> For the complete documentation index, see [llms.txt](https://intelfactor.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intelfactor.gitbook.io/docs/home/architecture/edge-native-architecture-three-zone-model.md).

# Edge-native architecture (three-zone model)

OT-safe boundaries that keep inspection running under real constraints.

IntelFactor is designed as a **three-zone system**. It matches factory security boundaries.

### Zone 1: Production Zone (OT)

**Lives here**

* Cameras.
* NVIDIA Jetson edge nodes.
* PLC / sensors (as applicable).
* Detection, local RCA, local evidence storage.

**Network policy**

* Air-gapped or strictly segmented.
* No outbound internet required.
* Optional conduit to the Site Data Zone.

**Failure mode**

* Must operate indefinitely on its own.
* Local DB + filesystem continue producing outcomes.

### Zone 2: Site Data Zone (on-prem IT/DMZ)

**Lives here**

* Local object storage (S3-compatible).
* Model registry.
* Dashboards and reporting.
* Container registry + update repository (if used).

**Network policy**

* Reachable from office network.
* Segmented from OT via firewall.
* No direct office-to-camera path.

**Failure mode**

* Edge inspection continues.
* Site dashboards and cross-line analytics may be unavailable.

### Zone 3: Remote Access Zone (optional)

**Lives here**

* VPN gateway and/or jump host for controlled remote visibility.

**Network policy**

* MFA required.
* Dedicated jump host.
* Session monitoring.
* Maintenance windows.

**Failure mode**

* Zero production impact.
* Inspection continues locally.