FedRAMP

FedRAMP authorisation determines whether a cloud service may be used by US federal agencies, and Impact Levels grade the sensitivity of data a system may hold. For an FDE the practical effect is that the deployment target, the model hosting and even the observability stack are dictated by the authorisation boundary rather than by engineering preference.

Worked example: a customer at IL5 cannot send prompts to a commercial hosted endpoint, so the same product ships as an in-boundary deployment with locally hosted weights and no outbound telemetry. Gotcha: authorisation is slow and mostly out of your hands, so the correct week-one move is to start the compliance conversation immediately and build against synthetic data while it runs.