How to Gate Sensitive Datasets by User Role on Shared Devices with AirgapAI

Become the admin who enables sharing without spillover. Multiple users, one device, zero leaks. For IT professionals managing environments like laboratories, training centers, or shift work, ensuring data isolation and safety is paramount. This guide provides a detailed workflow for implementing secure, role-based access to sensitive datasets on shared devices using AirgapAI, focusing on per-user folders, dataset scoping, Artificial Intelligence (AI) persona limits, and profile-based defaults. It offers practical security for real-world device sharing, including a comprehensive testing checklist.

Understanding the "Why": The Critical Need for Role-Based Access in Artificial Intelligence

In today's data-driven world, organizations are eager to harness the power of AI to boost productivity and innovation. However, this ambition often collides with stringent requirements for data security, privacy, and compliance. The challenges are particularly acute in multi-user or shared device environments, where sensitive information must be rigorously protected from unauthorized access or accidental exposure.

The Challenge of Data Security and Sovereignty

Traditional cloud-based AI solutions, while powerful, introduce inherent risks. When proprietary or classified data is uploaded to external servers, organizations lose direct control over that information. This can lead to:

• Data Leakage: The unintentional exposure of sensitive data to unauthorized parties.
• Compliance Hurdles: Difficulties in meeting regulatory requirements such as Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), or federal security mandates that often prohibit data from leaving an organization's controlled environment.
• Loss of Data Sovereignty: The inability to guarantee that data remains within a specific geographical or legal jurisdiction.

AirgapAI addresses these concerns by operating entirely locally on an Artificial Intelligence Personal Computer (AI PC). This means that all data processing, from ingestion to inference, occurs directly on the device, with no network "in" or "out" connections required. This fundamental "air-gapped" approach ensures your sensitive information never leaves your premises, maintaining absolute data sovereignty and significantly reducing the attack surface. This is especially vital for industries like financial services, healthcare, and government agencies where data privacy and security are non-negotiable.

Mitigating Artificial Intelligence Hallucinations and Ensuring Trust

One of the most frustrating aspects of many AI solutions is the phenomenon of "hallucinations"—where the AI generates inaccurate, nonsensical, or entirely fabricated information. This significantly erodes user trust and can lead to costly errors, especially when dealing with critical business or operational data.

AirgapAI tackles this head-on with its patented Blockify technology. Blockify is a sophisticated data management solution designed to optimize datasets specifically for Large Language Models (LLMs). It ingests vast quantities of raw data, deduplicates it, and distills it into concise, accurate "blocks" of information. Each block is tagged with rich metadata, including classification and permissions, ensuring that the AI draws answers only from a trusted, validated source. This rigorous process can reduce the original data size by as much as 97.5% and, remarkably, improve the accuracy of LLM responses by 78 times (a 7,800% improvement), virtually eliminating hallucinations. For IT professionals, this translates to AI outputs that are not only secure but also highly reliable and trustworthy, minimizing the need for manual validation and increasing confidence in AI-driven decision-making.

Cost Efficiency and Operational Control

The financial implications of enterprise AI deployment are often substantial, with many cloud-based solutions relying on per-user subscription models, hidden token charges, and escalating overage bills. These unpredictable costs can quickly undermine Return On Investment (ROI) and create significant budgetary strain.

AirgapAI offers a revolutionary approach to AI licensing: a one-time perpetual license per device. This model drastically reduces the Total Cost of Ownership (TCO), often coming in at 1/10th to 1/15th the cost of alternatives like Microsoft CoPilot or ChatGPT Enterprise. There are no ongoing subscription fees or hidden charges; once purchased, you own the license for the lifetime of that device, including all future updates and maintenance. This predictable pricing structure simplifies budgeting for IT departments and empowers organizations to "own their AI" without managing yet another subscription. Furthermore, by running AI locally, IT gains granular operational control over the entire solution, from deployment to data management, without external network dependencies.

The Shared Device Dilemma: Why Multi-User, Role-Based Access is Critical

In environments where multiple individuals share a single device—such as computer labs, training facilities, manufacturing floors, or call centers with shift workers—the challenge of data security is compounded. Without robust role-based access controls, there's a constant risk of users inadvertently or maliciously accessing sensitive data intended for others. For instance, a finance analyst using an AI PC might access a dataset containing legal contracts, or a manufacturing technician might query a proprietary Research & Development (R&D) database.

AirgapAI's design inherently supports secure multi-user environments by integrating seamlessly into existing IT image provisioning processes. It allows IT departments to configure personalized, role-specific datasets and experiences for each user, ensuring that sensitive data is gated precisely to those authorized to access it. This practical approach to security on shared devices is central to AirgapAI's value proposition, enabling organizations to leverage AI across their workforce without compromising confidentiality or compliance.

AirgapAI: Your Foundation for Secure, Local Artificial Intelligence

AirgapAI is not just another AI chat application; it's a comprehensive, offline, on-device large language model platform built for the enterprise. It empowers your workforce with the latest AI capabilities while upholding the highest standards of security, accuracy, and cost-effectiveness.

What is AirgapAI?

AirgapAI Chat is a locally installed, ChatGPT-like application that leverages open-source LLMs. It runs entirely on the client device, such as a Dell Precision workstation, eliminating external network dependencies. This "air-gapped" design ensures that your data remains within your organizational control at all times. It allows you to:

• Run open-source LLMs entirely on your Personal Computer (PC) (no cloud required).
• Upload private datasets via Blockify for ultra-accurate Retrieval-Augmented Generation (RAG) search.
• Interact through standard chat, guided business workflows, or Entourage Mode (multi-Artificial Intelligence persona role-play).
• Extend with your own models ("Bring Your Own Model") to tailor AI capabilities to specific needs.

The Power of the Artificial Intelligence Personal Computer (AI PC)

AirgapAI is optimized to harness the full potential of modern AI PCs, specifically those powered by Intel Core Ultra processors. These advanced machines are equipped with three powerful compute engines that work in harmony to efficiently handle diverse AI tasks:

• Central Processing Unit (CPU) - Fast Response: AirgapAI can utilize the CPU for tasks requiring extreme low latency, such as rapidly searching through millions of records in seconds.
• Graphical Processing Unit (GPU) - High Throughput: For running larger LLMs and compute-intensive tasks, AirgapAI leverages the highly performant, integrated GPU, delivering powerful AI capabilities without the additional cost or footprint of dedicated server hardware.
• Neural Processing Unit (NPU) - Power Efficiency: The NPU is specifically designed to handle sustained, heavily-used LLM AI workloads at low power, ensuring greater efficiency and optimal battery life for mobile users.

This intelligent allocation of AI workloads across the CPU, GPU, and NPU ensures peak performance, power efficiency, and a seamless AI experience directly on the device, even when offline.

Introducing Blockify Technology: The Engine of Accuracy and Control

At the heart of AirgapAI's trusted and accurate AI capabilities is its patented Blockify technology. Blockify is the ultimate data management solution for LLMs at scale, transforming raw, often messy, enterprise data into a highly optimized, accurate, and secure knowledge base.

Here's how Blockify works and why it's crucial for role-based access:

1. Ingestion and Distillation: Blockify ingests large data sets—such as thousands of sales documents, legal contracts, or Human Resources (HR) policies—and condenses them into concise, modular "blocks" of data. Each block includes:
   • A name (displayed in blue in the interface to quickly identify the content topic).
   • A critical question (the key query a user might ask related to the block's content).
   • A trusted answer (a distilled, accurate response derived from the source data, avoiding outdated or redundant information).
2. Security and Data Lifecycle Management: Critically, each block is tagged with rich metadata. This metadata includes classification levels, permissions, and other attributes essential for supporting zero-trust environments and data governance. For role-based access, this allows IT to precisely control which blocks (and thus which information) are accessible to different user groups or Artificial Intelligence personas.
3. Outcome Metrics: This meticulous process can reduce the original data size by as much as 97.5% (down to 2.5% of the original content volume) and, remarkably, improve the accuracy of LLM responses by 78 times (a 7,800% improvement). This not only saves storage space but fundamentally enhances the reliability and trustworthiness of your AI.

For role-based access, Blockify is the foundational layer. By carefully curating and tagging datasets through Blockify, IT administrators can ensure that each role or user group only interacts with the information directly relevant and authorized for their specific tasks, even on shared devices.

Step-by-Step Guide: Implementing Role-Based Access with AirgapAI

This section provides a detailed workflow for IT administrators to deploy AirgapAI with robust role-based access controls on shared devices.

Prerequisites: Setting Up Your AirgapAI Environment

Before configuring role-based access, ensure AirgapAI is correctly installed on your AI PC.

1. System Requirements: Verify that your AI PC meets the minimum or recommended specifications for optimal performance:

   • Central Processing Unit (CPU): Minimum 8 Cores; Recommended 8 Cores/16 Threads or better.
   • Random Access Memory (RAM): Minimum 16 Gigabytes (GB); Recommended 32 GB+.
   • Disk Space: Minimum 10 GB free (Solid State Drive (SSD)); Recommended 50 GB Non-Volatile Memory Express (NVMe).
   • Graphical Processing Unit (GPU) (Integrated or Dedicated): Minimum 4 GB+ Video Random Access Memory (VRAM) 2024 or Newer; Recommended 8 GB+ VRAM.
   • Operating System (OS): Windows 11 with latest patches.
   • Permissions: Security permissions to install.

2. Downloading the Installer Package: Obtain the latest AirgapAI installer ZIP archive from your internal or cloud link provided by IT. For example, AirgapAI-v1.0.2-Install.zip. Save it to a writable folder.

3. Installing the Application:

   • Right-click the ZIP file and select "Extract All..." Choose a destination and click "Extract."
   • Open the extracted folder.
   • Double-click AirgapAI Chat Setup.exe.
   • Follow the installer wizard: Accept the license agreement, choose to create a desktop shortcut, click "Install," and then "Finish."
   • If prompted by OS security (e.g., SmartScreen), choose "Allow" or "Run anyway."

4. First-Launch Onboarding Wizard:

   • Launch AirgapAI Chat via the desktop shortcut or Start menu.
   • On first run, click "Start Onboarding."
   • Enter a display name (default: "You").
   • Pick a preferred Chat Style (e.g., Iternal Professional, Casual, Dark Mode).
   • Click "Next."
   • Uploading the Core Large Language Model: Expand "Available Models" and click "Upload Model." Browse to the /models/ folder within your extracted installer and select a model suited to your hardware (e.g., Llama-1B for Integrated GPU or low-power, Llama-3B for Integrated GPUs from 2025 or dedicated GPUs). Click "Save." (Note: Core Large Language Models are stored in %appdata%\IternalModelRepo).
   • Uploading an Embeddings Model: Click "Upload Embeddings Model." Open /models/ and select Jina-Embeddings.zip. Click "Save." (Note: Embeddings Models are stored in %appdata%\IternalModelRepo).
   • Adding Sample or Custom Datasets: Datasets power Retrieval-Augmented Generation (RAG). Click "Upload Dataset." Navigate to /datasets/ from the install folder and select a sample (e.g., CIA_World_Factbook_US.jsonl). Click "Save." (Note: Datasets are stored in %appdata%\airgap-ai-chat\CorpusRepo).
   • Verify all three items are added, then click "Continue."

Understanding Data Isolation: User Profiles and Directory Structure

AirgapAI is designed for enterprise deployment and integrates seamlessly with standard Windows user profiles. This is fundamental to achieving robust role-based access on shared devices.

• Per-User Profile Configuration: AirgapAI can be imaged as part of the standard IT image process. When a user logs into a device with their unique Windows user profile, AirgapAI will create and manage its application data (including models and datasets) within that user's specific AppData directory. This ensures that each user has their own isolated experience and access to their designated data.

• Key Directories for IT Management:

  • Large Language Models and Embeddings Models: C:\Users\[User]\AppData\Roaming\IternalModelRepo
  • Blockify Datasets: C:\Users\[User]\AppData\Roaming\airgap-ai-chat\CorpusRepo

  By managing the contents of these directories for each user profile (either manually for small deployments or via centralized IT tools for larger fleets), administrators can enforce strict data isolation.

Curating Datasets with Blockify for Specific Roles

This is where the power of Blockify and role-based access truly converges. IT administrators will use Blockify to create and manage datasets tailored for distinct user roles.

1. The Blockify Process (Simplified for IT):

   • Ingest Documents: Identify the documents relevant to a specific role (e.g., a "Legal Team" might need all legal contracts and compliance documents; a "Marketing Team" might need brand guidelines and sales collateral). Blockify supports various file formats, including text, Hypertext Markup Language (HTML), Portable Document Format (PDF), Word, PowerPoint, and graphic files.
   • Create a Task: In the Blockify interface, create a new task (e.g., "Legal Contracts – Q3 2024").
   • Automated Extraction: Upload the documents. Blockify automatically extracts key information and distills it into blocks, each with a critical question and a trusted answer.
   • Human Review (Critical for Accuracy and Sensitivity): After ingestion, these blocks are sent for human review. This step is crucial to:
     • Update or Approve Messaging: Ensure all content is current and approved.
     • Flag Outdated Content: Identify and remove irrelevant information (e.g., "policy from 2019") before it impacts AI responses.
     • Verify Sensitivity: Confirm that no inappropriate or unauthorized data has been inadvertently included.

2. Metadata and Permissions: As blocks are created and reviewed, ensure they are tagged with relevant metadata. This metadata can include:

   • Classification: Public, Internal, Confidential, Secret, Top Secret.
   • Permissions: Groups or roles authorized to access (e.g., "Legal_Users," "Marketing_Team").
   • Data Source: Original document reference for auditing.

   This rich metadata supports zero-trust environments, allowing for fine-grained control over data access.

3. Updating and Distributing Datasets: As new documents are Blockified or existing policies change, datasets can be updated. These updated datasets, stored within the CorpusRepo, can then be efficiently pushed to local devices via enterprise image management solutions like Microsoft Intune, Ivanti Endpoint Manager, or similar applications. This ensures that users always have access to the most current and relevant information for their role, without manual intervention on each device.

Configuring Role-Based Workflows in AirgapAI

AirgapAI includes "Quick Start" workflows that can be tailored for different roles, enhancing both security and user experience.

1. Creating Quick Start Workflows:
   • Access the Workflow Bar (typically below the new chat window).
   • Administrators can create or modify workflow templates (in "Settings > Workflows") that automatically select relevant curated datasets based on the user's role.
   • For example, a "Procurement" workflow could automatically activate the "Vendor Contracts" dataset and provide pre-configured prompts like "Summarize key terms of vendor agreement X."
2. Assigning Datasets to Workflows: When creating or editing a workflow template, link it directly to the Blockify datasets relevant for that workflow. This ensures that when a user selects a "Legal Research" workflow, only the pre-approved and relevant legal datasets are activated, preventing access to, for instance, HR or marketing materials.
3. Leveraging Entourage Mode for Multi-Perspective Insights:
   • Artificial Intelligence Personas: Entourage Mode allows users to interact with multiple AI personas simultaneously. Each persona can be configured with specific expertise and datasets, mimicking subject matter experts.
   • Configuration: To set up personas, navigate to "Advanced Settings → Personas" within AirgapAI.
   • Role-Based Application: For role-based access, IT can pre-configure specific persona sets for different user groups. For example, a marketing professional might have access to "Marketing Strategist" and "Copy Editor" personas, each drawing from relevant marketing datasets. A legal professional could have "Corporate Counsel" and "Compliance Officer" personas, linked to legal and regulatory datasets.
   • Example Scenario: When preparing a complex proposal, a user could activate Marketing, Legal, and Technical Support personas simultaneously. Each persona would weigh in with different perspectives from their respective datasets, providing a multi-faceted view on complex issues. In a defense or intelligence scenario, a "CIA Analyst" persona (expert in intelligence gathering) and a "Military Tactician" persona (tuned for ground operations) could answer the same question, offering distinct, secure, and role-specific insights.

Deployment and Management for Multi-User Environments

AirgapAI's design facilitates streamlined deployment and ongoing management for IT teams.

1. Standard Imaging Process: AirgapAI is delivered as an executable file (.exe) that integrates straightforwardly into your standard Windows imaging process. IT can include AirgapAI as part of their "golden master image," ensuring it's pre-installed on all new AI PCs. Our deployment manual provides detailed instructions on imaging, provisioning, and role-specific configuration.
2. Pushing Updates and Datasets:
   • Application Updates: AirgapAI's update cadence is synchronized with typical OS or enterprise software update cycles. IT can deploy new application versions through familiar image management solutions. Updates are delivered by the built-in Update Manager, which can be configured to use a Local Server or Cloud in "Settings → Updates." (Note: The update file server location can be changed in C:\Users\[User]\AppData\Local\Programs\AirgapAI Chat\resources\auto-updater\updaterConfig.json).
   • Dataset Updates: As new documents are Blockified, the datasets are updated. These updated datasets can then be pushed to the local devices via Microsoft Intune or similar image management applications. This ensures data freshness and consistency across all users while maintaining isolation.
3. Multi-User Access on a Single Device: Because the application is tied to the user's profile on login, you can have multiple users of the same device, each leveraging the application with their own isolated experiences and datasets. This is configured per user profile through your standard image and provisioning process, ensuring that sensitive data and personalized workflows remain separate and secure for each individual.

Optional Advanced Configuration for IT Teams

For IT teams seeking deeper control and customization, AirgapAI offers several advanced configuration options:

1. Dell Technologies Dell Pro Artificial Intelligence Studio (DPAIS) Support: AirgapAI Chat supports native integration with Dell Technologies’ Dell Pro AI Studio. As the IT System's administrator, install the required files to enable an LLM via DPAIS (both Intel and Qualcomm are supported). After DPAIS services are running and validated, open PowerShell and input: [System.Environment]::SetEnvironmentVariable("DPAIS_ENDPOINT", "http://localhost:8553/v1/openai", "User"). Relaunch AirgapAI Chat, and DPAIS LLMs will appear in the model selection menu in settings.
2. Context-Window Expansion: After initial model benchmarking, administrators can go to "Settings → Model Settings" and set the "Max Tokens" slider up to 32,000, allowing the AI to process longer inputs and generate more comprehensive responses.
3. Styling & Themes: Under "Settings → Appearance," switch between predefined themes or build custom Cascading Style Sheets (CSS) for branding or accessibility.
4. In-App Benchmarking Suite: The "Settings → Benchmarking" tab allows IT to test the performance of new models on specific hardware configurations, measuring tokens per second and inference speed.

Ensuring Isolation and Safety: A Practical Testing Checklist

After implementing role-based access, thorough testing is essential to confirm that data isolation and security protocols are functioning as intended, especially in a multi-user, shared device environment.

Here's a practical testing checklist for IT administrators:

1. User Profile Isolation Verification:
   • Test Case 1: Log in as User A (e.g., "Legal_User"). Verify that User A can access only the datasets and workflows designated for the Legal team (e.g., "Legal Contracts," "Compliance Documents").
   • Test Case 2: While logged in as User A, attempt to access a dataset or workflow explicitly designated for another role (e.g., "Marketing Campaigns," "HR Policies"). This attempt should fail, or the dataset/workflow should not be visible.
   • Test Case 3: Log out of User A. Log in as User B (e.g., "Marketing_User") on the same physical device. Verify that User B has access only to Marketing-specific datasets and workflows.
   • Test Case 4: While logged in as User B, attempt to access User A's previously accessed Legal datasets. This attempt should fail, or the datasets should not be visible, confirming per-user data isolation.
2. Role-Based Workflow Functionality:
   • Test Case 5: Select a role-specific workflow (e.g., "Sales Proposal Generation"). Confirm that it automatically activates the correct underlying datasets (e.g., "Sales Collateral," "Product Specifications") and no unauthorized data.
   • Test Case 6: Test a prompt within the role-specific workflow to ensure the AI's response draws exclusively from the intended, curated dataset and adheres to the specified accuracy standards.
3. Entourage Mode Verification:
   • Test Case 7: Log in as a user authorized for Entourage Mode. Configure (or select a pre-configured) Entourage Mode workflow.
   • Test Case 8: Ask a question. Verify that each active Artificial Intelligence persona provides a response based on its assigned dataset and expertise, and that no persona accesses data outside its authorized scope.
4. Data Update and Deployment Integrity:
   • Test Case 9: Push an updated version of a dataset (e.g., "Latest HR Policies") via your image management solution.
   • Test Case 10: Log in as an HR user. Verify that the updated HR dataset is accessible and the AI queries reflect the new information.
   • Test Case 11: Log in as a non-HR user. Verify that they still do not have access to the HR dataset, confirming that updates do not bypass role-based restrictions.
5. Offline Functionality:
   • Test Case 12: Disconnect the AI PC from the network (Wi-Fi and Ethernet).
   • Test Case 13: Log in as any user. Verify that AirgapAI launches, models load, and users can access their assigned datasets and workflows, demonstrating full offline capability.
6. Performance and Stability:
   • Test Case 14: Run the in-app benchmarking suite after initial setup and any major updates to confirm expected tokens per second and inference speed on the target hardware.
   • Test Case 15: Conduct typical AI chat interactions with multiple users over a period to ensure stability and consistent performance.

By meticulously working through this checklist, IT administrators can ensure that their AirgapAI deployment effectively enforces role-based access, safeguarding sensitive data and providing a secure, productive AI experience for all users on shared devices.

Why Choose AirgapAI for Role-Based Access?

Implementing robust role-based access on shared devices for AI is a complex challenge, but AirgapAI simplifies it with a unique combination of features and benefits designed for the enterprise.

Unparalleled Security and Data Sovereignty

AirgapAI stands alone in its commitment to 100% local operation. By running entirely on the AI PC, your sensitive data never touches external clouds or networks. This inherently air-gapped design is ideal for highly regulated industries and environments, providing absolute data sovereignty and minimizing external security threats. For multi-user scenarios, this means each user's data remains isolated on their profile, eliminating the risk of cross-contamination or unauthorized access. This level of secure AI is unmatched.

Superior Accuracy with Blockify

The patented Blockify technology is a game-changer for AI reliability. By meticulously processing, distilling, and tagging your enterprise data, Blockify reduces AI hallucinations by an astounding 78 times (7,800% improvement). For IT, this translates into trusted AI outputs that require minimal validation, enhancing efficiency and confidence. When paired with role-based access, it ensures that not only is data segmented by user, but the information they do access is of the highest quality and accuracy.

Cost-Effectiveness and Simplified Licensing

Say goodbye to unpredictable cloud subscription fees. AirgapAI's one-time perpetual license model dramatically reduces your Total Cost of Ownership, offering AI capabilities at a fraction (1/10th to 1/15th) of the cost of leading cloud alternatives. This predictable, budget-friendly approach makes mass deployment across shared devices financially viable, providing a robust artificial intelligence solution without monthly payments.

Ease of Deployment and Management

Designed for the enterprise, AirgapAI integrates seamlessly into your existing Windows imaging and provisioning workflows. IT teams can effortlessly deploy, update, and manage the application and datasets across their fleet of AI PCs using familiar tools like Microsoft Intune. This ease of implementation means faster AI wins, reduced IT overhead, and a smoother user experience across all shared devices.

Flexibility and Customization

AirgapAI supports a "Bring Your Own Model" approach, allowing you to use popular open-source LLMs or integrate custom fine-tuned models tailored to your specific organizational needs. This flexibility ensures that your AI solution evolves with your business, providing a customizable artificial intelligence experience for all users, regardless of their role.

By choosing AirgapAI, you empower your organization with a private, secure, and highly accurate AI assistant that respects data privacy, enhances productivity, and delivers exceptional value, even in the most demanding multi-user environments.

Conclusion

Implementing role-based access on shared devices for sensitive datasets is a critical requirement for modern IT environments, from research laboratories to large-scale training centers. AirgapAI by Iternal Technologies provides the definitive solution, delivering a powerful, secure, and cost-effective artificial intelligence platform that operates entirely locally on the AI PC.

Through its patented Blockify technology, AirgapAI ensures unparalleled data accuracy and drastically reduces hallucinations, transforming raw data into trusted, role-specific insights. Its seamless integration with Windows user profiles and enterprise imaging tools allows IT administrators to easily configure and manage isolated datasets and workflows for each user, guaranteeing that sensitive information remains secure and accessible only to authorized personnel. With a perpetual license and no cloud dependencies, AirgapAI is the smart choice for organizations seeking robust data sovereignty, predictable costs, and a truly private, privacy-first artificial intelligence assistant.

Become the admin who enables sharing without spillover. Empower your workforce with secure, accurate, and cost-effective AI.

Download the free trial of AirgapAI today at: https://iternal.ai/airgapai