An engineer inside your segment
Forward-deployed engineers work inside the customer's own network segment, under the customer's access rules, on the customer's appliance. Here is what that means in practice.
· 4 min read
IN SHORT
A forward-deployed E31 engineer works inside the customer's network segment, with access granted under the site's own rules and withdrawn at the end. They build on the customer's Czar, read only the material in scope, and reach only the systems the scope names through declared routes. No tooling, model, or data path reaches outside the segment, in any posture.
Forward-deployed means more than on site. It means inside the segment: the part of the customer's network where the appliance sits, where the desk's systems live, and where the site's own access rules apply. The engineer works there, under those rules, for the length of the engagement.
This is a deliberate constraint, and it is the thing that makes the rest of the forward-deployed form possible. This article describes what it looks like from the site's side.
Access is the site's to grant
An E31-certified engineer arrives with no standing access to anything. The site grants what the scope needs: a role on the appliance, read access to the material the use case may read, and whatever the site's rules require for reaching the systems named in the scope.
The site grants it the way it grants access to any contractor working inside the segment. Its identity system, its device rules, its approval chain. The practice does not ask for an exception and does not bring an alternative path.
At the end, the site withdraws the access. There is no account that outlives the engagement and no session left open. The engineer's ability to touch the appliance ends when the work does.
The work happens on the appliance
Everything the engineer builds is built on the customer's Czar, in the customer's segment. The agents composed in Agency Studio, the corpora indexed by Substrate, the adapters trained on the site's own material, the routes declared to the site's systems, the versions published and the run record they generate. All of it lives on the appliance from the first day.
This matters for a plain reason. There is nothing to move in at the end. A version built somewhere else and migrated into the segment arrives with questions: what was it built against, what did it touch on the way, does the environment match. A version built on the appliance it will run on has none of those questions.
It also means that when the engineers leave, the customer is not inheriting a copy. They are keeping the original.
The boundary applies to the engineer too
Inside the segment, the engineer's own tools obey the same boundary as the use case. There is no model running outside the segment that the engineer consults with the site's data. There is no path from the appliance to a cloud workspace. The retrieval, inference, adaptation, and evaluation the engineer needs are on the appliance, because that is what Substrate provides.
On a connected site, the engineer reaches only the systems the customer already secures, through routes the scope declares. On an air-gapped site, nothing reaches out at all, and material and updates move by the site's media procedures. On a mixed estate, each building keeps its own posture and the engineer works inside whichever one they are in.
This is not a hardship the practice absorbs. It is the reason certified engineers are trained to work inside sovereign and connected sites. An engineer who needs an outside path to do the work is not ready for forward-deployed work.
What the segment makes possible
Working inside the segment is what lets the engineer sit with the desk. The desk's systems are there. The people who run it are there. The real packet, the one that arrives through the site's own systems and lands in the site's own records, is visible only from inside.
It is also what lets the engineer build with the operators rather than for them. When the operators can look at the version in Agency Studio on the appliance they will run it on, the handoff is not a separate event. It is happening the whole time.
And it is what makes the end clean. Engineers who leave no path out is only possible if there was never a path in that the site did not control.
What the site should prepare
A site preparing for a forward-deployed engagement needs a place for the engineer to sit near the desk, the access the scope names granted under the site's own rules, and the appliance in the rack. The practice page at /practice describes how certified engineers work, and sitting with the desk describes what happens once they are in.
Questions this raises
- Does the engineer bring their own laptop into our segment?
- The engineer works under the site's rules for devices and access. On many sites that means a site-issued workstation inside the segment. The practice does not require a path from the engineer's own equipment to the appliance.
- What can the engineer see while inside the segment?
- What the scope names and what the site's roles allow. The material the use case may read, the systems it may call, and the appliance itself. Access beyond that is not needed for the work and is not requested.
- Does working inside the segment slow the engagement down?
- It removes a category of problems rather than adding one. Because the work is built where it will run, there is no migration at the end, no environment mismatch, and no question about what left the building.
KEEP READING