How to Build a Sovereign Operational Intelligence Stack

Palantir packages familiar enterprise disciplines—data integration, governed semantic models, workflow applications and model deployment—into one coherent system. Its public architecture documents expose the same recognisable layers: Ontology, data integration, Workshop applications and model integration. The difficult value is the coherence between them, not a novel foundation-model layer.

The builder's opportunity is not to reproduce Foundry feature for feature. It is to recover perhaps 80% of the operational value—an explicit design target, not a measured universal result—by joining mature open components around one bounded use case. The hard part remains identifiers, data quality, permissions, ownership and an interface that fits the work.

This guide is for data engineers, operations teams and government or enterprise teams that need to prove the shape before making a platform-scale commitment. The weekend exercise is intentionally narrow: one redacted or synthetic source, one graph domain, one decision screen and one measurable outcome.

Choose object storage deliberately

Do not start a new community deployment on MinIO by default. Its community repository was archived on 25 April 2026, is read-only and now describes the community edition as source-only; the embedded web interface is an object browser rather than the former administration console. Existing installations can still run, but an unmaintained storage layer is a migration risk, not a neutral default.

Start with the graph, not “AI”

A relational schema is useful when rows and joins are stable. Operational questions usually cross changing relationships—shipment to vehicle, vehicle to depot, depot to incident, incident to responsible team—so a property graph can attach attributes to both entities and relationships without forcing every question into one rigid table shape; JanusGraph documents this model through Apache TinkerPop and Gremlin.

Keep the lake authoritative

Land raw and cleaned records in versioned Iceberg tables, then project only the operational entities and relationships needed into the graph. This makes the graph a serving model rather than the only copy of reality, and Iceberg's documented snapshots support reproducible reads and rollback.

Put workflow before models

A queue of delayed shipments with an owner and an acknowledge action is useful without an LLM. Add Ollama or vLLM only for a narrow task such as classifying free-text incident notes; keep rules, permissions and final actions outside the model.

The ingestion tier receives database changes, files and field events through Kafka, NiFi or a small batch loader. The storage/ontology tier writes immutable source records and curated Iceberg tables to object storage, then maps stable operational identifiers and links into JanusGraph. The serving/UI tier uses Trino or Spark for queries, Superset or a small LocStat-inspired application for decisions, and an optional model endpoint for bounded classification or extraction.

Bilawal Sidhu's spy-satellite simulator and follow-up idea IronSight are useful interface provocations for two different jobs. WorldView combines public spatial feeds in one navigable scene. IronSight synchronizes ordinary camera footage, reconstructs a shared 3D scene and keeps human-labelled tests and visible failure cases beside the polished replay. Neither project proves production sensor access, identification accuracy or operational readiness.

Use public feeds as fixtures and supplements—not as authority

Public feeds make the interface concrete, but they arrive with different coverage, licences, clocks and failure modes. This first matrix separates what made the prototype visually persuasive from what an accountable production system would need instead.

Compare public feeds and production fallbacks6 sources · caveats · owned routes

Source	What the prototype used	Production caveat	Owned or authoritative fallback
OpenSky Network	Sidhu reported 7,000+ changing aircraft positions. The API exposes live state vectors, tracks and flights.	Coverage is receiver-dependent, quotas apply and operational or commercial use requires a written agreement. Treat identity and completeness as unverified.	Replay a licensed snapshot for development; for operations, use the aviation authority's approved feed or your own authorized receivers and retain the raw messages.
ADS-B Exchange	Crowdsourced aircraft positions, including an API endpoint filtered to aircraft marked military.	API access is commercial and entitlement-based. A transponder flag is not authoritative identity, intent or a complete air picture.	Use it as a supplementary layer beside approved surveillance data; use synthetic tracks when real identifiers or movements are unnecessary.
CelesTrak GP data	The demo selected 180+ satellites and propagated their orbits from published element sets.	TLE or OMM records are orbital elements, not continuously observed live positions. Surface element epoch, propagation time and expected error.	Pin a dated element-set fixture for tests; use the organisation's approved space catalogue or sensor-derived track when the decision is consequential.
OpenStreetMap	Road geometry under a particle effect that suggests vehicle flow.	OpenStreetMap supplies mapped features—not live vehicle movement. Attribute the data, and do not build production traffic on the community tile servers.	Self-host approved OSM extracts and tiles, then join the road graph to the transport authority's GIS, counters or licensed flow data.
City of Austin traffic cameras	Geolocated public camera imagery projected into the 3D scene.	Austin's dataset publishes locations and, where allowed, a latest screenshot on a five-minute cadence. It explicitly disclaims survey suitability and does not retain daily video.	Use approved internal camera services, retention rules and surveyed asset locations; store fixture images for development and outage tests.
Google Photorealistic 3D Tiles	A high-resolution textured city mesh rendered in CesiumJS.	It requires billing, an API key and on-screen attribution; Google restricts caching, offline use, extraction and machine analysis. EEA terms and returned content can differ.	Keep the operational layers independent of the basemap. Fall back to government terrain, orthophotos and 3D city models served through the existing GIS.

The full, searchable operational-intelligence catalogue—including owned GIS and self-hosted map routes—is in Tools.

From feeds to governed records. Once each source has an authority level and an outage path, the next job is to keep observations, resolved identities, derived assessments and operator actions distinct. Otherwise a polished map quietly turns uncertain reports into apparent facts.

Inspect the operational data and decision layers5 layers · minimum records · guardrails

Layer	Minimum record	Operator view	Guardrail
Base world	Terrain or imagery tile, provider, capture date, resolution and licence.	A 2D map or 3D globe with scale, coordinates and imagery age visible.	Do not let attractive basemaps imply that the scene is live.
Reported observation	Source ID, observed-at and received-at times, geometry, classification, confidence and raw-record link.	Selectable marks, trails and time controls; stale and low-confidence records look distinct.	Preserve the report separately from the entity it may describe.
Resolved entity	Stable internal ID, source aliases, proposed matches, reviewer and merge history.	One object dossier with every supporting and conflicting observation.	Never merge identities only because two marks overlap on screen.
Derived assessment	Rule, query or model version; inputs; generated time; output; uncertainty; expiry.	An overlay that can be hidden and traced back to evidence.	Label inference as inference; expiry prevents an old assessment becoming a permanent “fact”.
Workflow action	Case, assignee, permitted action, decision, rationale, timestamp and outcome.	Triage queue and case panel beside the map—not just more glowing layers.	Require human authorisation for consequential actions and preserve the audit event.

Build the time machine before the live map

Normalize each connector into an observation envelope and retain both event time and ingestion time. Record a feed heartbeat, expected update interval, last successful record and licence or redistribution constraint. Then replay a saved time window at different speeds. Deterministic replay makes late events, duplicate suppression, entity resolution and operator decisions testable without depending on a live third-party feed.

Separate reality, simulation and presentation

Keep three explicit namespaces: observed records received from a source, simulated tracks created for training or demonstration, and derived interpretations produced by rules or models. Show a permanent mode banner and source legend, and prevent simulated objects from crossing into production alerts. A sensor cone, orbital path or coverage footprint is a model output unless it came from a documented source; its assumptions belong in the object panel.

Use a thin geospatial serving path

Store raw payloads immutably, curate geometry and timestamps into Iceberg, relate identities and cases in the graph, and publish bounded vector tiles or GeoJSON through an authenticated API. CesiumJS or MapLibre should receive only the viewport, time range and fields the operator may see. Cluster and aggregate on the server; do not stream the whole lake into the browser.

World Monitor's account of its origin says it began as a weekend project in January 2026. It now publishes a free dashboard, paid Pro and API plans, and an Enterprise offer. That is evidence of a commercial product and pricing structure—not evidence of revenue, profit or customer retention. The distinction matters when using a successful-looking build as a business case.

As checked 23 July 2026, the shared dashboard URL restored a global seven-day view and its selected layers. The live interface exposed cached or live status, source age, coverage counts, methodology links, resizable panels and a command palette. Those small contracts make a dense map inspectable, reproducible and shareable; they are more valuable to copy than its visual drama.

Borrow the product seams, not the public-dashboard topology

World Monitor's documented architecture—vanilla TypeScript, browser-side work, Redis-backed caches, scheduled seeders, edge functions and a separate live-data relay—is a coherent response to a public, read-heavy product. A private sovereign stack still needs an authoritative lake, an operational graph, organisation identity, row- or object-level policy, durable workflow state, audit and tested restore. Its consumer topology is evidence for specific patterns, not a reference architecture to copy whole.

Keep code, data and brand rights separate

The published licence guide says the platform is AGPL-3.0-only, while named thin client packages are MIT-licensed; it also separates commercial licensing and trademark permission. A modified public network deployment may therefore carry source-offer obligations, and upstream feed licences or API terms remain separate. For a sovereign build, either use the interfaces as learning material and implement your own bounded system, comply with the AGPL, or negotiate different terms before combining the code with a proprietary product.

Commercial check, 23 July 2026: the published plan table listed Pro at $39.99/month, API at $99.99/month, API Business at $249.99/month and custom Enterprise pricing. These are vendor-published prices, not audited revenue.

AI is useful where operational data becomes ambiguous: extracting entities from incident notes, suggesting that two records refer to the same asset, classifying a message, summarising a long case or translating an operator's question into a read-only query. These are proposed interpretations of evidence, not new facts.

Keep inference as a derived, traceable record

Store the source identifiers, prompt or task version, model and adapter version, timestamp, output, confidence where meaningful, reviewer decision and superseding result. This lets a later model produce a new interpretation without rewriting history. Apply the same access policy to prompts and outputs as to the source data they contain.

Use the cheapest adequate intelligence

Start with SQL, rules, graph traversals and established statistical or optimisation models. Add a small instruction-tuned model through Ollama when the data must remain local, or vLLM when an internally controlled GPU service needs higher throughput. The relevant deployment choices are compared in the site's local-model guide, DGX Station guide and self-hosted model guide.

Fail closed and degrade usefully

Timeouts, malformed output and model refusal should return the operator to the ordinary queue, saved query or rule-based result. Model access goes through one authenticated gateway with task-specific schemas, budgets and logs; the model does not receive database credentials or direct write access.

Service references: Amazon MSK, Azure Event Hubs for Kafka, Google Managed Service for Apache Kafka, Amazon S3, Google Dataproc and Azure HDInsight Spark.

There are two credible VMware shapes. Use ordinary vSphere VMs when one team owns the stack and operational simplicity matters. Use Kubernetes through vSphere Supervisor, or tenant clusters exposed through Cloud Director Container Service Extension, only when the datacentre already operates that control plane.

A practical vSphere layout

Begin with three security zones: ingestion VMs can reach approved sources; data VMs host Kafka or NiFi, SeaweedFS/Iceberg, JanusGraph and Trino; serving VMs host Superset, the workflow API and optional Ollama. Put Airflow or Prefect in the data zone, forward only bounded telemetry to the monitoring zone, and send audit logs to an append-restricted target.

Availability without theatre

Use vSphere anti-affinity rules to separate replicas across hosts, but test application failure rather than assuming VM restart equals service recovery. Back up configuration, graph data, the Iceberg catalog and object data on their own schedules; restore them into an isolated network and replay a known decision case before calling the design recoverable.

Cloud Director is a control plane, not a data policy

Cloud Director can provide isolated organisations, virtual datacentres, networks and quotas; its API documentation is the interface to automate those boundaries. If a managed-datacentre provider operates vSphere or Cloud Director, contract terms and privileged access still determine whether “private” meets the sovereignty requirement.

Most small “Palantir clone” repositories should be treated as rapidly assembled prototypes. That is not a dismissal: a working screen is often better than a slide deck for asking operators what they need to see, which actions belong beside an alert and what context is missing. It is not evidence that the repository should own production data, identity or workflow state.

Give the coding assistant a job, not a repository

A useful request is: “Study this incident triage screen and implement the same operator journey in our existing application using these API contracts, design tokens, permission checks and acceptance tests.” A poor request is: “Rewrite this clone in our language.” The first preserves an outcome and constraints; the second reproduces unknown assumptions.

Five deployed patterns with measured outcomes. These are not promises for a new build: they show decisions worth instrumenting, the data that had to be joined and the denominator a pilot should reproduce.

Call the project a sovereign operational intelligence platform or an owned decision-support capability. The credible proposal is that a six-person team, assisted by coding tools, can build a narrow production slice around one mission or workflow—not reproduce every Foundry or Gotham feature.

The bottleneck moved; it did not disappear

Our operating judgement is that the scarce role is the product owner who understands both the mission and the data. Outsourcing traditionally inserts translation between operators, analysts and developers; fast AI-assisted implementation can widen that gap by producing polished software before the decision rule is understood. Keep the operational owner embedded with the team and require weekly observation of real or replayed work.