Local Bridge and the systems the site secures

A facility already has a security boundary. Inside it sit the systems the site depends on: a warehouse system that knows where every item is, a plant historian that records what every machine did, a document store full of procedures and drawings, a message bus that carries events between them. These systems have owners, access controls, and change windows. The site already defends them.

Local Bridge is the Substrate service that lets the appliance join that set of systems without enlarging it. It is the only way the platform reaches anything outside its own enclosure, and it reaches only what the site has declared.

What the bridge is for

The clearest case is Retrieval. Grounded answers with citations need a corpus to ground in, and the corpus is the site's own documents. Those documents live somewhere already, in a store the site maintains. A declared route from Substrate to that store lets Retrieval read it, index it on the appliance, and answer questions with citations back to the source. The documents do not move to a new system; the appliance reads them where they are.

The second case is results. A perception model that reads a damaged label, a language model that drafts a shift note, a VLA policy that decides how a robot should grasp an unfamiliar item: each produces something a downstream system may need. A route to the warehouse system or the plant control layer lets an application hand results across, under a policy that says what may be handed.

The third case is events. Many sites run a message bus on the plant segment. A route to that bus lets applications built on Substrate subscribe to what the floor is doing and publish what the models concluded. Again, the bus is the site's. Substrate becomes one more participant on it, with a declared role.

What stays the same for the site

The systems on the far end of a route do not change. The warehouse system keeps its own access control. The historian keeps its own retention. The document store keeps its own permissions, and Retrieval sees only what the route was granted. Local Bridge does not ask the site to open those systems more widely than they already are. It asks for a specific path with a specific purpose.

This is why a connected posture is still described as nothing leaving the building. The far end of every route is inside the same perimeter as the appliance. Data moves between two systems the site owns, over a path the site declared, within walls the site controls. There is no third party in the exchange and no path out of it.

The security team does not have to learn a new model either. They already review which systems may talk to which. A Local Bridge route is one more entry in that review, written in the same terms: this system, that system, this kind of traffic, this direction.

How a route behaves under policy

Every route carries a policy. The policy limits what kind of exchange is permitted and in which direction. A route to a document store might permit reads only. A route to a message bus might permit publishing to specific topics and subscribing to others. The policy is set when the route is declared, by someone with authority on the site, and it can be tightened or withdrawn later without disturbing anything else on the platform.

The exchanges are visible. Evaluation traces every AI operation, and Local Bridge activity is part of the same record. An operator can see which routes were used, when, and by which application. If a route is removed, its history remains in the record, so the question of what the appliance was connected to last quarter has an answer even after the connection is gone.

Choosing routes deliberately

The temptation, when a platform can connect to things, is to connect it to everything useful on day one. Local Bridge is built to resist that. A route is a deliberate act with a name, a purpose, and a policy. Sites that start with no routes and add them one at a time, each tied to a specific application, end up with a connectivity map they can explain in a sentence.

That is the goal. A site should be able to say exactly which of its own systems the appliance can reach, and why, and show the list to anyone who asks. Local Bridge is how Substrate makes that sentence true, and the platform overview at /platform shows where it sits among the seven services.