AI Blueprints
Agentic AI Suite
AirgapAI Products
Iternal AI Blueprint Builder
Enterprise AI initiative decision framework.
Evaluate AI opportunities across value, feasibility, cost, governance, risk, adoption, and implementation readiness.
Regulated & Public Sector
Commercial & Operations
AirgapAI Chat
Local, air-gapped LLM chat for classified environments.
Runs entirely on your own hardware for CUI, HIPAA, and other regulated workloads — no data leaves your network.
Explore AirgapAIGuides
AirgapAI Comparisons
Best-Of Guides
Benchmarks & Indexes
AI Strategy Blueprint
Free Chapter 1 (32 pages, PDF) — the framework behind 4 #1 Amazon best sellers.
Get your free chapterTraining by Role
Training by Industry
Learn & Research
On edu.iternal.ai
Iternal AI Academy
AI fluency for every role in your company.
912+ courses · 10-minute lessons · role-based paths.
Company
Partnerships
Contact
Work with Iternal
See the platform in a live demo.
Product walkthroughs for AirgapAI, Blockify, the AI Blueprint Builder, and the AI Academy.
Book a demo
AI Blueprints
AI Blueprint Builder AI Blueprint Books AI Strategy Guide (Hub)Strategy & Advisory
AI Strategy Consulting Fractional Chief AI Officer AI Executive Education AI Team Training AI AcademyAI Consulting Services
AI Consulting AI Implementation Services Machine Learning Consulting AI Data & Analytics Consulting Digital Transformation Consulting AI Agent Development Services AI Governance Consulting Generative AI ConsultingAgentic AI Suite
Turnkey SI Ultramemory Agent Skills Library AgentAuth Ultracache Iternal Workforce Waypoint RFP Blockify PRISM Nebulous IdeaFORGEAirgapAI Products
AirgapAI Chat AirgapAI Transcribe AirgapAI Code All PricingRegulated & Public Sector
Federal Contractors (CUI/CMMC) Defense & Aerospace State & Local (SLED) Healthcare & HIPAA Legal & Law FirmsCommercial & Operations
Financial Services Manufacturing Energy & Utilities Edge Deployment All IndustriesBy Role
CISOs & Security IT Leaders Compliance Officers Enterprise ArchitectsBooks & Partners
AI Partner Blueprint AI Strategy Blueprint Book AI Strategy Framework Free Partner Chapter AI Partner ProgramTools
AI ROI Calculators AI Readiness Assessment Browse All Assessments LLM Pricing CalculatorGuides
Guides by Job AI Cost & Budget Guide LLM Selection & Benchmarks Best Local AI Tools (Enterprise) On-Prem Hardware Sizing How to Deploy LLMs On-Premise Local LLM Deployment Guide Private LLM Guide AI Agent Security Checklist Agentic AI AI Agent Orchestration What Is an MCP Server? Token Usage & Cost Projections Reducing AI Token Costs How to Write AI PromptsLibrary
Case Studies Webinars Book a Demo Events What is Iternal? What is Blockify? Release NotesAirgapAI Comparisons
vs Microsoft Copilot vs ChatGPT Enterprise vs Google Gemini vs Amazon Q vs Azure OpenAIBlockify Comparisons
All Blockify Comparisons Best Vector Databases Best RAG Frameworks Best Data Ingestion Tools Best AI GovernanceBest-Of Guides
Best Copilot Alternatives Best ChatGPT Alternatives Best Local AI Tools Best AI Books Best AI Consulting Firms Best AI Strategy Frameworks Top AI Companies in Austin Best Secure AI Transcription Best Private AI Coding Assistants Best Private AI Appliances Best Secure AI TranslationBenchmarks & Indexes
LLM Benchmark Repository All ComparisonsGet Started
Overview & Pricing Plans & Pricing AI-Fluency Quiz (2 min) AI Training for Teams Enterprise AI Training Guide Student Free AccessTraining by Role
For Marketing Teams For Sales Teams For Executives For Finance Teams For HR Teams For Legal Teams For OperationsTraining by Industry
For Manufacturing For Government For HealthcareLearn & Research
Best AI Training Courses AI Training for Employees How to Write AI Prompts AI Skills Gap AI Training ROIOn edu.iternal.ai
Browse All Courses Verify CertificateCompany
About Iternal Leadership CareersPartnerships
Partners AI Partner BlueprintContact
Contact Iternal Book a DemoFollow
LinkedIn TwitterThe Iternal platform formerly called Turnkey AI
Turnkey SI gives an organization one place to sign people in, assign product roles, route requests to the AI models it has configured, set usage limits and review what was used. Permission checks run on product actions and agent calls.
What's new: September 28, 2026 release notes
What is Turnkey Superintelligence (Turnkey SI)?
Turnkey SI is Iternal's platform for using AI products inside an organization. Each person has one account and a personal space, team organizations contain workspaces, and applications open inside a workspace. Joining an organization does not grant product access: a person also needs a product role, and the product must be enabled for the organization. Turnkey SI was called Turnkey AI before the rename.
People sign in through the built-in OpenID Connect provider, and each product action is checked against declared actions, resources and role grants. Agent tool calls are checked against the permissions of the person who consented.
Authenticated AI requests go through one runtime that applies usage limits and model routing, and each request is recorded as metadata by user, workspace and organization.
A single Helm chart installs the platform with PostgreSQL, NATS messaging, object storage and the monitoring stack bundled, and an operator CLI handles key custody and planned upgrades.
Iternal supports Executive Order 14434, which makes Super Intelligence the term U.S. federal agencies use for AI. Turnkey Superintelligence takes its name from that term: the order writes it as two words and Iternal writes the product name as one. Iternal supports the term because it names what the technology delivers rather than how it was made. Turnkey SI is not an AI model: it routes calls to the models an organization configures, governs access and records usage.
A CIO's platform team can install and operate the platform on Kubernetes, choose which models serve each AI capability, and attribute token usage to a user, workspace or organization.
A CISO gets product actions checked against declared policy, agent tool calls checked against the consenting person's permissions, envelope-encrypted provider credentials and attributed change records in covered modules.
A CEO scopes the program with AI Blueprint Builder and starts with one use case, such as Contract Intelligence, which draws on the Blockify and Nebulous add-ons.
Privacy and compliance leads get a 30-day restore window for deleted team organizations and workspaces, then purge or erasure in participating modules while audit security evidence is kept, plus change records that can be filtered and exported.
On a prepared Kubernetes cluster running version 1.34 or later, the operator runs helm install for the iternal-platform chart. The platformctl CLI prepares key custody, secrets and escrow around that install. Browser sign-in and agent access are enabled by setting domain exposure, which uses a base domain and a Gateway API gateway.
An owner creates the organization and its workspaces, groups people and assigns product roles. Product entitlements set which products each organization may use.
An administrator configures model providers, routes each AI capability through model pools and sets request, token and concurrency limits. Provider credentials are stored under envelope encryption.
Administrators review AI requests and token usage by user, workspace or organization, and filter the audit log for changes in covered modules. Alerts reach the receivers the customer supplies.
Turnkey SI Contract Intelligence ingests enterprise agreements and analyzes them for risk, compliance and financial recovery. It draws on optional add-ons including Blockify for data ingestion and Nebulous for prioritization.
See Contract IntelligenceAn administrator creates a workspace, groups the team and assigns product roles, with an expiry where the role allows one. Product actions are checked against those roles. The administrator also sets request, token and concurrency limits on AI use and reviews AI requests and token usage by user and workspace.
A qualified MCP (Model Context Protocol) client signs in and sees only the tools its user may call. Most tools are read and inspection tools. The agent captures, searches and corrects workspace memory through five Ultramemory tools, and the person's permissions apply to each call. Removing the person's access removes the tools from the agent's next listing.
The base platform has sixteen capabilities and there are six optional add-ons. Four more are available in Early Access and one is on the roadmap.
| Area | Base platform | Optional add-ons |
|---|---|---|
| Identity and access | ||
| AI control | None | |
| Memory and knowledge | ||
| Records and data lifecycle | None | |
| Operations and deployment | None | |
| Business applications | None |
Optional add-ons are separate Iternal products, each deployed and administered on its own.
Sign-in, permissions, product access and agent tool access in the base platform. AgentAuth is an add-on with its own deployment and administration.
Organizations, workspaces, groups and roles
Organizations, workspaces, groups, invitations and role assignments, with one user identity across the apps on the platform. Role assignments can carry an expiry where the role allows one, and an expiring-soon review lets owners extend, renew or revoke them.
Built-in OpenID Connect sign-in
Built-in OpenID Connect sign-in with passkey and password login, plus sign-in through upstream OpenID Connect providers that the operator configures per deployment, using one Google-compatible adapter. It is active in domain exposure mode.
One decision point that denies by default
Checks product actions against declared actions, resources and role grants, and denies an action when it is undeclared or when the check itself fails. Iternal declares and maintains the policies in code.
Product access gated per organization
Gates each product per organization through granted rights, hard suspensions, and feature and capacity ceilings; with no granted source, access fails closed. In an installation on a customer's cluster, rights come from imported, Iternal-signed licenses.
Agent access bounded by the person it acts for
An MCP (Model Context Protocol) server where signed-in agents discover and call platform tools, with each tool listing and call checked against the signed-in person's live permissions. It speaks MCP 2026-07-28 and works with qualified MCP clients that Iternal has tested. Iternal builds and maintains the tool catalog. It is active in domain exposure mode.
Short-lived credentials for AI agents
A self-hosted broker that gives AI agents short-lived, narrowly scoped tokens instead of static API keys, and keeps an append-only record of every issuance. Delegated tokens can only narrow scope, lifetime and audience, and AgentAuth runs as its own deployment beside your identity stack.
Which models serve each request, how much AI each organization may use, and where provider credentials live.
Prioritized, weighted model pools and staged rollouts
Routes each model call through prioritized, weighted pools, with staged rollouts between a baseline pool and a candidate pool. Provider prompt caching is available as an opt-in setting.
Request, token and concurrency limits
Request, token and concurrency limits on AI work, counted per organization, workspace, person, app or agent, plus a monthly token allowance for platform-provided AI. Request and concurrency limits are enforced at admission, and token limits reserve an estimate and reconcile to reported usage. Limits are set in tokens and requests.
Envelope-encrypted provider credentials
Envelope-encrypted storage for AI provider credentials, with operator-managed key custody, escrow to at least two custodians and key rotation. The keyring is held in Kubernetes.
Workspace memory in the platform, plus optional add-ons for source-attributed knowledge blocks and document analysis.
Workspace memory for people and agents
Durable workspace memory that people and agents capture, search and correct. Agents reach it through a bearer-token API and five MCP tools, and a correction supersedes the earlier memory while keeping its version lineage. Recall uses keyword (full-text) search, and per-user and per-workspace quotas apply.
Data ingestion and knowledge governance
Converts enterprise documents into source-attributed knowledge blocks, merges duplicates, and flags contradictions for human review so AI answers stay traceable. Retrieval returns blocks with their sources for the answering agent.
Bulk document reading for expert review
A no-code add-on that reads contracts, questionnaires and PDFs in bulk, extracts key terms, and drafts outputs for expert review. A human expert reviews every draft, and the add-on works with Blockify.
What happened, who did it and what remains after deletion.
Metadata-only AI activity and token records
Metadata-only activity and token-usage records for each authenticated AI request, viewable by user, workspace or organization, without storing prompts or responses.
Attributed change events in covered modules
Attributed audit events are committed with each change in covered modules and relayed to one central log that authorized users can filter by event type, actor and resource. Export is NDJSON, up to 90 days and 50,000 rows, through the browser.
30-day restore, then purge or erasure
Deleted team organizations and workspaces stay restorable by their owners for 30 days, then participating modules purge or erase their data while audit security evidence is kept.
How the platform installs, runs, alerts and reaches administrators.
Kubernetes install and operator tooling
A Helm chart, which requires Kubernetes 1.34 or later, installs the platform, and the platformctl CLI prepares key custody and escrow, rotates keys and handles planned-window upgrades. The operator runs helm install, and upgrades run in planned maintenance windows.
Disconnected networks with offline license checks
Supports installation on disconnected networks with local sign-in, and verifies Iternal-signed license files offline against keys built into the release. The customer supplies local DNS, a private certificate authority, time, storage, an image registry and locally reachable AI inference, and enforces outbound-network denial on its own network. Disconnected installation is available in Early Access. Contact Iternal for more information.
Metrics, logs, traces and eight alert rules
The chart bundles metrics, log and trace storage with eight platform alert rules, one of them a heartbeat that checks the alert path, each with a runbook link that the operator can repoint. Alerts go to the notification receivers the customer supplies, and each component can be disabled.
In-app inbox, diagnostics triage, optional email
An in-app notification inbox, retained error and problem-report diagnostics that System administrators triage, and optional email.
Optional Iternal products that apply AI to planning, prioritization and content production.
Guided interview to executive AI strategy documents
A guided interview that turns your team's answers into AI strategy documents covering ROI, governance, architecture, risk, training and pilot planning, each addressed to a specific executive role.
AI Blueprint BuilderBusiness-value prioritization
Gives every ticket and task one priority order by business value: leadership sets top-level objectives, they cascade through programs, projects and tasks, and any change recalculates downstream priorities. It prioritizes work and works beside your existing ticketing tools.
Personalized content production
Assembles reusable one-idea content blocks into videos, podcasts, decks and documents, personalized to each recipient from a spreadsheet, CRM segment or campaign list. A changed block rebuilds every format that uses it.
Four items are available in Early Access and one is on the roadmap. Contact Iternal for more information.
Reusable skills for agents, with revision history
A versioned library of reusable skills with revision history and a review queue, fetched by agents through an API. Available in Early Access. Contact Iternal for more information.
Unified Business Operations
Iternal's own back-office system, which pulls email, meetings, orders and files into one ontology and tracks open commitments for an organization. It runs as its own deployment. Available in Early Access. Contact Iternal for more information.
AI-drafted requirements with human approval gates
A person or connected app files a capability request, AI drafts the requirements, design, security review and implementation plan, and a workspace administrator approves the requirements and design. Available in Early Access. Contact Iternal for more information.
Managed digital employees (Iternal Workforce)
A managed-agent product designed so that each agent has a named human sponsor, acting capabilities need approval by default, token budgets pause work when exceeded, and a three-tier kill switch pauses one agent, one agent definition or a whole workspace. Available in Early Access. Contact Iternal for more information.
Developer kit for customer-specific applications
A developer kit for building customer-specific applications on the platform's sign-in, permissions, AI access, entitlements and audit services. On the roadmap. Contact Iternal for more information.
Turnkey SI is designed to run in a cloud deployment that Iternal operates or on a Kubernetes cluster that the customer operates, from the same Helm chart.
Iternal runs the platform in a cloud environment from the same codebase and Helm chart as an installation on a customer's cluster.
The operator runs helm install for the iternal-platform chart on a prepared Kubernetes cluster, and platformctl prepares key custody, secrets and escrow around it. A default install runs one replica with internal-only exposure, and the operator switches on domain exposure, email, the local model server, database backups and autoscaling by configuration.
Supports installation on disconnected networks. Sign-in uses local authentication, and licenses verify offline against keys built into the release. Iternal's procedure prepares the release outside the isolated network and transfers it in. Available in Early Access. Contact Iternal for more information.
| Area | Details |
|---|---|
| Kubernetes | The chart requires Kubernetes 1.34 or later, and the cluster supplies Gateway API v1, storage, DNS and TLS. Contact Iternal to confirm your cluster and architecture for an Early Access deployment. |
| Upgrades | Upgrades run in planned maintenance windows. |
| Disconnected networks | Local sign-in and offline license verification. The customer supplies local DNS, a private certificate authority, time, storage, an image registry and locally reachable AI inference, and enforces outbound-network denial. Available in Early Access. Contact Iternal for more information. |
| Local AI models | An optional local inference server can be deployed beside external AI providers, using the model and serving image you supply. GPU inference is available in Early Access. Contact Iternal for more information. |
| Database backup configuration | Opt-in PostgreSQL backup configuration, and verification and restore of the root-key escrow. End-to-end backup and restore is on the roadmap. |
| Optional email delivery through one cloud email provider type. | |
| Default install | A default install runs one replica with internal-only exposure. The operator sets domain exposure with a base domain and a Gateway API gateway to enable browser sign-in and agent access, and switches on email, the local model server, database backups and autoscaling by configuration. |
These controls describe the base platform; optional add-ons are administered on their own.
| Control | What it does | Scope |
|---|---|---|
| Sign-in | Passkeys, passwords and upstream OpenID Connect sign-in through one built-in provider, in domain exposure mode. | Upstream sign-in uses OpenID Connect through one Google-compatible adapter. |
| Authorization | Product actions are checked against declared actions, resources and role grants, and denied when the check fails. | Iternal declares and maintains the policies in code. |
| Agent access | Each tool listing and call is checked against the signed-in person's live permissions and the scopes the person granted. | Qualified MCP clients, with the tool catalog built and maintained by Iternal. |
| AI records | Request, user, workspace, outcome and token counts are recorded for each authenticated AI request, with the model route when the request reaches routing. | Records hold metadata only, with no prompts or responses. |
| Change records | Attributed audit events are written with each change in covered modules and can be filtered and exported. | Covered modules, filterable by event type, actor and resource. |
| Credentials | Provider credentials are stored under envelope encryption with escrowed, rotatable keys. | Keys are held in a Kubernetes keyring under operator-managed custody. |
| Deletion | Deleted team organizations and workspaces are restorable for 30 days, then purged or erased. | Team organizations and workspaces, with audit security evidence retained. |
| Usage limits | Limits admit or deny provider calls before the provider is contacted. | Limits are set in tokens and requests; token limits reserve an estimate and reconcile to reported usage. |
| Tenant scoping | Each request is authorized against the caller's organization and workspace, and queries are scoped to them. | Enforced in the application query layer. |
The AI Blueprint Builder interviews your team and evaluates your initiative across business value, technical feasibility, cost, governance, risk, adoption and readiness, so you scope and sequence an AI program with evidence before you commit budget.
Yes. Turnkey SI is the same Iternal platform under a new name; it was called Turnkey AI before the rename. The contract-intelligence product that carried the Turnkey AI name is now Turnkey SI Contract Intelligence, one use case of the platform, at iternal.ai/turnkeysi/contract-intelligence. A turnkey AI platform comes with its supporting software bundled: Turnkey SI installs from a single Helm chart that bundles PostgreSQL, NATS messaging, object storage and monitoring.
The base platform covers sign-in, permissions, product entitlements, agent access through an MCP server, model routing, usage limits, AI usage records, change records, credential storage, recoverable deletion, workspace memory, installation tooling, monitoring and notifications. Optional add-ons are AI Blueprint Builder, Blockify, Nebulous, IdeaFORGE, AgentAuth and Document Intelligence. Each add-on is a separate Iternal product, deployed and administered on its own. Skills Library, Agent Workforce, UBO and Agentic SDLC are available in Early Access, and the Custom Solution Development SDK is on the roadmap. Contact Iternal for more information.
Turnkey SI requires Kubernetes 1.34 or later. It is designed to run in a cloud deployment that Iternal operates or in a cluster that the customer operates, and it supports disconnected networks: sign-in uses local authentication, licenses verify offline, and the customer supplies local DNS, a private certificate authority, time, storage, an image registry and AI inference, and enforces outbound-network denial. Disconnected installation is available in Early Access. Contact Iternal for more information, including how to confirm your cluster and architecture.
Qualified MCP clients, which are the agent clients Iternal has tested against its MCP version 2026-07-28 server, connect through the permission-checked MCP server on behalf of a signed-in person. Each tool listing and call is checked against that person's live permissions and the scopes the person granted, so a listing or call outside the person's permissions is denied, and a revoked permission removes the tool from the next listing. Usage limits then cap the requests, tokens and concurrency that an app or agent can consume.
For each authenticated AI request, Turnkey SI records the request, the source app and user, timestamps, the outcome and the token counts. When a request reaches routing, the record also names the model pool, the model and the routing decision. The records do not hold prompts or responses. Administrators view them by user, workspace or organization.
Contact Iternal to discuss your application. Iternal adds applications to the platform, and the Custom Solution Development SDK for independently deployed applications is on the roadmap. External programs such as desktop apps, command-line tools and AI agents can act for a signed-in user through OAuth with PKCE and MCP, with product administration reserved for people.
Turnkey SI includes a built-in OpenID Connect provider with passkey and password sign-in, and it signs users in through upstream OpenID Connect providers that the operator configures per deployment, using one Google-compatible adapter. Browser sign-in uses domain exposure mode. Contact Iternal to discuss other identity requirements.
Turnkey SI is available in Early Access. Start with the AI Blueprint Builder to scope your AI program, or request a demo, and contact Iternal for more information, commercial terms and what an engagement includes.
Iternal walks your team through the Turnkey SI console and scopes the add-ons your first use case needs.
Turnkey SI is available in Early Access. Contact Iternal for more information. The walkthrough recording uses demonstration data.