Hybrid architectures place models, context, tools, policy, and evidence independently according to privacy, capability, latency, cost, and availability.
Key takeaways
- Local control with hosted model
- Data classification must be explicit.
- Fallback and rollback behavior should be tested.
Patterns
- Local control with hosted model
- Local model with enterprise tools
- Edge inference with cloud refinement
- Multi-provider model route
- Federated evidence
Placement decision
| Question | Why it matters |
|---|---|
| Data classification | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
| Route transparency | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
| Offline fallback | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
| Cross-region state | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
| Provider incompatibility | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
| Trace correlation | Record the constraint, assumption, and accepted trade-off in the Runtime Decision Record. |
Failure and fallback
Define behavior for network loss, provider failure, device pressure, cache loss, invalid artifacts, and unavailable tools. A fallback must preserve data policy and output contracts; it should not silently broaden authority.
Implementation checklist
- Document the control, execution, data, and evidence locations.
- Pin artifact, runtime, and policy versions.
- Test cold start, steady state, overload, failure, and rollback.
- Expose data movement and hosted fallback to users where relevant.
- Record cost and capacity assumptions.
Hybrid data-flow contract
Every local-to-hosted transition should be represented as a contract containing data classification, purpose, destination, model route, retention, encryption, redaction, consent, and fallback. Context assembly can minimize the transfer by selecting only the sources required for the task. Tool results and model responses returning to the local side should retain provenance and policy metadata so the local evidence record can explain what happened.
Identity must also cross the boundary safely. The hosted runtime should receive a scoped workload identity or delegated token rather than a user’s long-lived credential. Local tools should not accept free-form hosted model output as authority. They should receive a typed request that is revalidated against local policy immediately before execution.
Hybrid failure modes
- Hosted model unavailable while local tools remain available.
- Local policy or evidence store unavailable while hosted inference succeeds.
- Network interruption after a remote request is accepted but before the response arrives.
- Version mismatch between local contracts and hosted routes.
- Duplicate action after reconnect or workflow replay.
- Remote response contains data that local retention policy prohibits.
For each case, define whether to retry, switch models, operate locally with reduced capability, pause for approval, reconcile status, or stop. The fallback path should never expand data access or tool authority.