Sean Egan
Ask the agent

Systems / DEPLOYMENT · AWS GOVCLOUD · 2026-09-25

A DoD AI guide behind a CAC

A DoD AI field guide that borders on controlled information, moved to GovCloud and put behind a Common Access Card the day the account was approved.

1
day from account approval (16:34Z) to live behind the card2026-09-25
2
hostnames: one that never asks for a certificate, one whose only job is the handshake2026-09-25
8 h
lifetime of the signed session cookie2026-09-25
~3.2M
entries in DoD certificate revocation lists, versus a 500,000-entry cap on the load balancer's trust store; the reason the design changed2026-09-25
¼
the monthly cost of the revised design relative to the first2026-09-25
46
files in the guide, in beginner, intermediate, and advanced tiers2026-09-16

A DoD guide to using generative AI needed to live where controlled information can, reachable only with a Common Access Card. I threw out the first design the same afternoon, because the load balancer couldn't check DoD's revocation lists, and shipped a two-host design with live revocation checking. It went live the day the account was approved.

The problem

The GenAI Field Guide teaches people how to use generative AI correctly at work: where your text goes, which tool for which job, what to check before you sign. Parts of it border on Controlled Unclassified Information, so it couldn't stay on a commercial VPS, and it needed to be reachable only by people holding a DoD credential.

What I built

The first design was an application load balancer with built-in mutual TLS in front of a container. I threw it out the same afternoon: the load balancer can only check revocation against lists uploaded to its trust store, capped at 500,000 entries, and DoD's lists total about 3.2 million. It also gates the whole hostname, which means every visitor gets a certificate prompt before they can even read the landing page.

The shipped design splits the job across two hostnames. The content host never requests a client certificate. Clicking "Continue with your CAC" sends you to a separate sign-in host whose only job is the handshake, validated against the DoD certificate bundle with live OCSP revocation checking. On success it mints a signed, eight-hour session cookie and sends you back. Every later request checks the cookie. No certificate, verification failure, missing card, and OCSP unreachable each land on their own state on a landing page rather than a raw error. An operator switch can open the site for testing without ever re-enabling the certificate prompt.

An open edition of the guide, with the department-specific material removed by a scanner that must report zero hits before it can build, is public on this site.

How it’s checked

The open-edition scanner is a hard gate in the build. The CAC flow was exercised with a real card in each failure state before the switch was thrown. The design document records the rejected design and why, so nobody rebuilds it.

What happened

Live at gov.theinformed.org/gen-ai/ since 2026-09-25 19:15Z, with the old address redirecting so existing links and QR codes still work. The open edition is at /ai-tools/.