How is the AI pipeline isolated from the rest of the application?
The AI processing runs in isolated pipeline workers (isolated processing services) that communicate via message queues (SQS):
Stateless: Each worker is stateless and processes one task at a time.
No direct database access: Workers access S3 to read document contents but have no direct access to the database. Results are reported back to the orchestrator service via SQS.
Private subnets: All workers run in private subnets within the VPC.
Ephemeral containers: Worker containers are short-lived — memory is freed after the task completes.
IAM access restrictions: Access to SQS and S3 is restricted by IAM policies to authorized services only.
This architecture limits the blast radius: a compromised AI worker cannot access data stores laterally.