The true bottleneck to enterprise AI isn't finding the right model, it's connecting AI securely to the fragmented reality of corporate data. Atolio's permission-aware knowledge layer now runs as a jointly validated workload on IBM Fusion HCI, giving enterprises a way to put AI to work on their own knowledge without that knowledge ever leaving their perimeter.
IBM and Atolio have partnered to address the problem that stalls most enterprise AI programs: the mandate is real, the budget is cleared, and there’s still no safe way to point a model at what the company actually knows.
The joint solution pairs Atolio's permission-aware enterprise knowledge layer with IBM Fusion HCI, IBM's turnkey OpenShift appliance for private and hybrid AI. Atolio runs as a workload entirely inside an organization’s own compute boundary. Connectors, index, embeddings, and inference all execute there, and credentials and API tokens stay there. IBM and Atolio have published the joint architecture and sizing guidance in a solution brief, covering configurations from a 50-user proof of concept through 20,000 users. The solution is available through both companies.
Why IBM partnered with Atolio
Fusion HCI ships as a pre-validated stack of compute, GPU, NVMe storage, and networking. Organizations deploy it because AI has become a board-level commitment. The first production workload to run on that infrastructure is often still an open question.
A knowledge layer answers it, and the case rests on more than search quality.
It pays off across the whole company rather than one department. Legal, compliance, engineering, sales, support, HR, and finance all draw from a single deployment, so the investment is justified by company-wide use when finance asks who benefits from the spend.
It also asks nothing that breaks the sovereignty premise. Atolio was built to run self-hosted. There’s no cloud dependency to architect around, no egress to negotiate, and no vendor-side copy of the index sitting somewhere else. Air-gapped operation is a supported configuration rather than a special engagement.
Then there’s the effect on models already in place. Atolio stays deliberately model-neutral, supplying governed context to watsonx, Granite, Claude, OpenAI, Gemini, Llama, Copilot, or a team's own internal agents. Better context produces better answers from the models an organization has already paid for, with no need to replace any of them.
Fusion without a knowledge workload is capacity waiting for a use case. Atolio without a sovereign substrate is a retrieval layer looking for somewhere it can legally run.
How the two halves fit together
The reference architecture below shows what that division looks like in a deployed cluster.
Two details in that table do most of the work in a security review.
Permissions are enforced at the index, at the moment of the query, rather than filtered in the interface afterward. Atolio extracts object-level ACLs from each source system and stores them per document. A person, an agent, or a model retrieves exactly what that person is already authorized to see in the system of record. Nothing is granted. Nothing is overridden.
Atolio’s Collaboration Graph handles relevance. It maps who each person works with, which projects and systems they’re active in, and how those relationships shift over time, then applies that at query time to rank results for the specific person asking. Keyword match returns what matches. This returns what matters to you.
What changes for the people using it
A compliance officer gets a regulatory request with a 48-hour clock on it. The evidence sits in executed contracts, audit logs, policy documents, and three years of email. Assembling it by hand runs most of two days. One query now returns everything she is authorized to see across every connected system, cited back to source, and those two days go back on the calendar.
The same mechanism shows up in less dramatic places:
- An engineer triaging a Friday incident pulls up the design doc, the original decision thread, and the prior postmortem for a service whose author left six months ago.
- A platform team finally ships the internal agent that had been stuck in security review, because the agent inherits Atolio's access controls instead of needing a permission model of its own.
- New hires ramp on searchable history rather than on whoever happens to be free that afternoon.
Employees also stop pasting sensitive material into public chatbots. Shadow AI is a symptom of an internal option that does not work well enough, and it recedes once the sanctioned option answers the question faster.
The cost effect is measurable. Unranked retrieval pushes whatever it finds into the model and bills for all of it. Atolio filters and ranks before inference, so fewer tokens reach the model per query, and cheaper models become viable for simpler tasks.
When sovereignty is written into the contract
Some organizations treat data residency as a strong preference. For others it’s regulation, contract language, or classification policy, and it rules out external AI services before an evaluation ever begins.
Public sector, defense, financial services, and healthcare buyers get an architectural answer here rather than a contractual one. Retrieval, embeddings, and inference all execute inside the Fusion HCI perimeter. Deployments can run air-gapped with no internet egress. Clearance boundaries and information barriers hold at the point of retrieval because Atolio inherits them from the systems of record instead of reimplementing them in a second, parallel access model that somebody then has to govern.
Procurement gets a supportable, pre-validated platform with a single accountable owner.
Sizing and deployment
The joint sizing guidance covers four configurations on Fusion HCI: a 50 to 100 user proof of concept, 1,000 users, 5,000 users, and 20,000 users, each specified down to control nodes, compute nodes, GPU nodes, and networking.
Because Fusion HCI arrives pre-validated and Atolio ships as Helm charts with its connector fleet, first production deployment is measured in weeks. We’ve already done and documented the integration work that normally precedes a private AI deployment.
Learn more
Book time with us to learn more about how Atolio and IBM Fusion HCI empower your organization to unlock the full value of your enterprise knowledge safely, securely, and completely under your control.
We’ll walk through the architecture, sizing given your user count, and where your teams are currently losing the most time to scattered knowledge.
FAQs
1. What is the IBM and Atolio partnership?
IBM and Atolio have partnered so that Atolio's permission-aware enterprise knowledge layer runs as a jointly validated workload on IBM Fusion HCI. IBM and Atolio have published joint architecture and sizing guidance, and the solution is available through both companies.
2. What is a sovereign AI knowledge layer?
It’s a knowledge layer that indexes an organization's information across its systems, enforces those systems' permissions at query time, and runs entirely inside the organization's own compute boundary. No content, credentials, or index data leave the perimeter, and no external service is required for retrieval or for inference.
3. Does any enterprise data leave the environment?
No. Connectors, document extraction, the search index, embedding generation, and model inference all run inside the customer's Fusion HCI cluster, and API tokens stay in the customer environment. Air-gapped deployment is supported.
4. Which AI models work with Atolio?
Atolio is model-neutral. It supplies context to whichever model your organization currently runs, including Granite, Claude, OpenAI, Gemini, Llama, Copilot, and internally-built agents. With this approach, swapping models later does not require rebuilding the retrieval layer.
5. Does this require an existing IBM relationship?
No. Organizations with no current IBM footprint can deploy the joint solution, and existing Fusion HCI customers can add Atolio to infrastructure already installed.
6. Can Atolio run on my existing infrastructure, and where does IBM Fusion fit?
Yes. Atolio is self-hosted and runs in your existing VPC, Kubernetes cluster, or supported Red Hat OpenShift environment, with no IBM Fusion or new hardware required.
IBM Fusion software requires Red Hat OpenShift and does not run on generic Kubernetes. Where you already run it, Atolio deploys into the same OpenShift environment alongside Fusion's data and storage services, subject to validating your configuration. IBM Fusion HCI integrates compute, storage, networking, OpenShift, and optional GPU acceleration into one turnkey stack, removing the integration work that normally precedes a production AI deployment.
That leaves three paths: your existing infrastructure, Fusion software where you already run it, or Fusion HCI for a complete AI-ready platform.
About Atolio
Atolio is a self-hosted, permission-aware enterprise knowledge layer. It connects the documents, chats, email, tickets, wikis, code, and CRM records scattered across an organization into a single governed index that employees, AI assistants, and agents can retrieve from safely. Atolio runs entirely inside the customer's environment, whether on-premises, in a private cloud or VPC, or on Red Hat OpenShift.
About IBM Fusion HCI
IBM Fusion HCI, also known as IBM Storage Fusion HCI, is an integrated hyper-converged platform combining compute, GPU, storage, and networking into a single pre-validated stack built on Red Hat OpenShift. It provides a Kubernetes-native foundation for containerized applications, virtual machines, and AI workloads running on-premises or in hybrid cloud environments.