Emergency management wants on-prem primary AI plus cloud burst. What should architecture define?

Emergency management that keeps on-prem AI as primary with cloud burst needs architecture that defines hybrid failure domains: what remains available if cloud regions degrade, what bursts when on-prem saturates, and how state, identity, and networking behave across those domains. Explicit failure-domain design turns hybrid from a slide into a runnable municipal plan. Assuming cloud and on-prem always fail together with no plan ignores independent outage modes and blocks useful burst/failover thinking. Deleting the on-prem cluster and relying on ad-hoc personal clouds removes the primary civic control plane and invites unmanaged risk. Disabling outbound connectivity so burst can never activate contradicts the burst requirement and wastes the hybrid investment. Exam caveat: hybrid burst needs pre-staged images, quotas, network paths, and data gravity awareness—DNS flipping alone does not move multi-terabyte civic training sets in an incident. Operational check: document and test a tabletop where on-prem GPUs saturate or a cloud region fails; confirm primary stays local as designed, burst paths authenticate, and emergency jobs land in the intended domain without deleting on-prem. Municipal emergency architecture should name ownership for each domain—who declares burst, which identity broker issues short-lived cloud credentials, and how on-prem remains authoritative for life-safety inference when the public cloud path is degraded. Write those runbooks before the incident, including rollback when burst capacity is no longer required.