The foundation

We productionize the NVIDIA RAG Blueprint.
We never fork it.

NVIDIA describes its Blueprints as reference solutions — flexible starting points that developers adapt and extend into production. That downstream role is Enclave's entire product: the Blueprint is the retrieval engine, and Enclave is the governed application built on top of it. Enclave tracks upstream Blueprint releases, so every deployment inherits NVIDIA's ongoing investment in ingestion, retrieval, and inference.

RAG Blueprint
the NVIDIA reference architecture we build on
Per-GPU
NVIDIA AI Enterprise subscription attached to every NVIDIA-edition deployment
$30–250k
the deployment band we serve, below where global integrators engage

The stack

Layer by layer

Enclave runs as four hardened services above the NVIDIA stack. Everything below the Enclave layer is standard NVIDIA software, deployed as NVIDIA ships it.

Enclave application layerSSO gateway · RBAC · permission-aware retrieval · SharePoint & file-share connectors · LangGraph agent orchestration · sandboxed analysis · chat application · admin console · audit · usage accounting · evaluation harness
NVIDIA RAG Blueprintmultimodal ingestion (NVIDIA NeMo™ Retriever extraction) · hybrid vector search · reranking · generation pipeline
NVIDIA NIM™ microservicesaccelerated inference for NVIDIA Nemotron™ open models, embedding, and reranking
NVIDIA AI Enterprisethe supported, production-ready software platform — subscription licensed per GPU
NVIDIA-accelerated hardwareNVIDIA RTX™ PRO workstations to multi-GPU servers — sized per workload in the Assessment

The orchestration

The Blueprint is a round trip. Enclave makes it a supervised loop.

Out of the box, the Blueprint runs the same five steps on every question — one fixed pipeline, one shot, stateless. Excellent retrieval, and single-purpose by design:

ingestor-server · nv-ingest — the ingestion side

rag-server · POST /v1/generate — the round trip

question

streamed answer + citations

Anyone who can
reach the port

query
rewrite

embed query
(NeMo Retriever NIM)

hybrid search
(Elasticsearch)

rerank
(NeMo Retriever NIM)

generate
(LLM NIM)

documents

multimodal extraction
text · tables · charts

embed

Elasticsearch
+ object store

The stock round trip. Every step is NVIDIA software, deployed as shipped. What it does not know: who is asking, what they are allowed to read, what happened last turn, or whether the question needs retrieval at all.

Enclave's LangGraph orchestrator does not replace that pipeline — it makes it one of several specialists. A supervisor routes each turn with a structured decision; specialists do the work and report back; the supervisor looks at what has been gathered and routes again — up to six hops, under wall-clock and search budgets — before composing the answer. The Blueprint's round trip is what the rag specialist calls:

needs documents

needs computation

needs a live system

passages gathered

charts + tables gathered

results gathered

no retrieval needed

enough gathered

/v1/search

turn starts

supervisor
routes with a structured decision:
rag · code · tools · respond · synthesize

rag agent
permission-scoped search
via the Blueprint

code agent
plan → script → locked
Docker sandbox

tools agent
typed tools + MCP servers

respond

synthesize
composed answer with
inline citations

streamed to the user

NVIDIA RAG Blueprint
(Diagram 1, stock)

A greeting never triggers a vector search. "Chart the scrap rate from the workbook" goes to a locked sandbox, not to retrieval. "Search, then compute on what you found" takes two hops — something a fixed pipeline cannot express. Every route decision streams to the user as a visible reasoning step.

And because the loop runs inside the platform, governance is woven through every hop — the retrieval filter is built server-side from the asker's permissions before the engine is ever called, and the whole turn lands in the audit log:

Blueprint (stock)orchestratorenclave-apiUserBlueprint (stock)orchestratorenclave-apiUservalidate token · resolve groupslook up collection grantssupervisor routes: "needs documents"supervisor: "enough gathered" → synthesizecomposed answer, inline citationsappend-only audit row:who · collections allowed vs querieddocuments cited · model · tokensquestion (OIDC token)turn + signed identity (120s JWS)/v1/search — filter built server-sidefrom the asker's grants onlyreranked passagesSSE: reasoning steps · citations · deltas · usagestreamed answer + "How I got this" trail
One governed turn, end to end. If the asker holds no grant covering the answer, the search returns empty and the platform says so — a grounded refusal, cited to nothing, recorded like every other turn.

The division of labor

What the Blueprint provides. What Enclave adds.

The NVIDIA RAG Blueprint is deliberately decomposable — a modular reference architecture, not a finished enterprise application. Its own documentation describes the included interface as a sample, not a production surface. That is by design: the application layer is where independent software vendors are meant to build. This table is the honest split.

CapabilityNVIDIA RAG BlueprintEnclave adds
IngestionMultimodal extraction — text, tables, charts, imagesUpload lifecycle, per-corpus collections, connector-driven sync with deletion reconciliation, chunking tuned per corpus
RetrievalHybrid vector search with rerankingPermission-aware scoping per user and group, enforced server-side on every query; multi-collection strategy under budgets
GenerationAccelerated inference with citationsAgent orchestration (routing, multi-step tool use, sandboxed analysis), answer verification, streaming reasoning trail
IdentityOIDC single sign-on, role- and group-based access control, group sync from the identity provider
InterfaceSample interface for evaluationProduction chat application (white-label), projects/workspaces, admin console
GovernanceOptional guardrailsAppend-only audit trail with per-turn permission scope, usage accounting, guardrail profiles, prompt-injection defense
QualityScored evaluation harness, customer gold sets with negative controls, written acceptance criteria, quarterly quality reports
OperationsDocker Compose / Helm reference deploysHardened deployment profiles, mTLS between services, secrets management, backup/restore runbooks, managed-operations tier

Why this matters to the ecosystem

Every Enclave deployment grows the NVIDIA platform

License attach

Every NVIDIA-edition deployment requires an NVIDIA AI Enterprise subscription, licensed per GPU and resold with the engagement — recurring NVIDIA software revenue on hardware that would otherwise run an unsupported stack.

Blueprint adoption

Enclave converts Blueprint evaluations into production deployments — the exact pilot-to-production step the Blueprint is designed to seed. We track upstream releases, so customers stay on current NVIDIA software.

Band coverage

Enclave serves the $30–250k deployment band: below the threshold where global systems integrators engage, above what an IT team can self-assemble from a repository. Coverage where the ecosystem is thinnest.

Public-sector and regulated buyers are Enclave's focus: environments governed by DFARS 252.204-7012 and NIST SP 800-171, no-cloud-AI policies, and disconnected networks — where a supported, fully on-premises stack is the requirement, not a preference.

INDUSTRY FOCUS · PUBLIC SECTOR & REGULATED MID-MARKET

Provenance

Built by people who have shipped this stack

Enclave's founder deployed the NVIDIA RAG Blueprint in production while building a U.S. state treasury's private AI platform — multi-agent retrieval over sensitive financial data, local models, enterprise SSO and role-based access — and rebuilt the application layer clean-room as the Enclave product. Enclave is a member of the NVIDIA Partner Network (Independent Software Vendor).

Next step

See the stack running.

A live walkthrough of Enclave on NVIDIA hardware — sign-in to cited, permission-scoped answer — takes about fifteen minutes.

Contact us