Can enforcing row-level security on RAG retrieval run inside a government and public sector VPC or air-gapped environment?

Yes. Kastra ships as a single binary that runs in your VPC, on-prem, or fully air-gapped. Government and public sector customers deploy Kastra inside their compliance boundary; policy and evidence never leave their environment.