Factory Private
Enterprise AI
Private AI for model research and post-training
September 24, 2026 - 2 minute read
Private AI deployment becomes a research requirement when the working environment contains unreleased model weights, evaluation data, and proprietary training code. An agent needs enough access to perform useful engineering, while the organization needs control over where that context travels.
The Factory Private launch describes a concrete deployment. NVIDIA’s Nemotron research team used Factory in its on-premises environment for post-training Nemotron 3 Ultra, including evaluation and optimization. That is a specific published use case, rather than a claim that every research workload needs the same infrastructure.
Jian Zhang, Director of post-training on the Nemotron Research team, explains the value of observing the work:
“Detailed task trajectories and verified outcomes helped us understand how the model used tools and recovered from errors, guiding our next post-training cycle.”
Private AI needs a complete research boundary
Model research produces more sensitive material than the final patch. Tool output can expose evaluation examples. A traceback can reveal internal paths. A session history can connect a failed experiment to an unreleased model. Review those artifacts alongside source code when deciding what may leave the environment.
Factory’s deployment documentation separates the runtime, control plane, inference endpoints, and telemetry collectors. A fully airgapped pattern has no runtime dependency on Factory cloud. Models and collectors operate inside the isolated network, while binaries arrive through the organization’s offline artifact process.
Customer-hosted execution alone does not establish that boundary. If a model gateway forwards requests to an external provider, inference follows that external path. The approval must cover the service behind the gateway, as well as the machine running Droid.
The research team also needs a reproducible environment. Preserve the evaluation version, model revision, dependency set, and allowed tools for each run. Otherwise, an improved result could come from a changed test fixture or runtime rather than a meaningful change in agent behavior.
Private AI should preserve usable evidence
A successful command is only part of an evaluation record. Keep the task description, intermediate failures, tool choices, and final validation together. This lets a researcher distinguish a direct solution from a recovery that succeeded after several bad assumptions.
Factory’s telemetry privacy documentation distinguishes metrics from optional message-content logging. Content traces require explicit configuration and a customer collector. Decide whether the study needs those traces before collecting them, then apply access and retention controls appropriate to the material they contain.
Preserving evidence also means separating observation from authority. A trajectory can show that a model attempted a command. The independent test result establishes whether the resulting change worked. Keep that validation outside the agent’s own summary.
For an initial pilot, use a bounded evaluation or optimization task with an existing acceptance test. Compare the result with the team’s current process, including researcher intervention and failed attempts. Record what the agent could access and what it actually used.
NVIDIA’s example supports a practical direction for private deployment: make protected engineering work observable inside the approved environment. It does not establish a universal quality improvement, token saving, or authorization for another organization’s data.
