Reference architectures for private, governable AI

The gateway is a small service, not a platform purchase: an authenticating reverse proxy with a classifier, a policy table and a log sink. The classifier does not need to be a large model; a rules-plus-NER pass that flags national ID numbers, account numbers, phone numbers, names and health or biometric terms is enough to route correctly. The policy table is where the Act becomes code: "class = personal → allowed_models = in-country" is a single row. The log is what lets the DPO answer an access request under s.14 and what evidences "ongoing monitoring and testing of AI models" under RBZ PS 01-2024 para 7.2.8.

Two Zimbabwean specifics. First, embedding is a transfer: if you compute embeddings with a hosted API, every chunk of every policy and contract has left the country. Open-weight embedding models run comfortably on a single server, so there is no reason to do that. Second, the index is a "critical database" in the ordinary sense of the Act's definitions and holds copies of whatever you ingested; it needs the same retention, access and breach controls as the source systems, and it must be included in the processing you have notified to the Authority (SI 155 s.10(2)(a)).

The pattern deliberately separates three things vendors often bundle: the runtime that plans, the gateway that permits, and the adapters that touch systems. The gateway is yours. Its allow-list is short, its policy table is reviewable by internal audit, and its audit record is the evidence the RBZ Guideline asks institutions to maintain for "risk assessments, approvals, vendor due diligence, and technology audit trails" (para 6.4(c)). For control patterns in more depth see enterprise agent patterns.

Prefer components you can run on two mid-range servers in a Zimbabwean colocation facility: an open-weight LLM in the 7–70 billion parameter class, an open-weight embedding model, a vector index inside your existing database engine, and a gateway you can read the source of. Use hosted frontier models through the gateway for non-personal classes where quality justifies the forex cost, with a budget cap. For the choice between open and hosted models, on-premises and regional cloud, and the cost model, see model strategy; for the threat model behind these diagrams see security; for where data may legally sit see the data residency briefing.