SATPC0043194 Tab 04 4 SOW REDACTED.pdf

SOW – AI Enterprise Self-Hosted Application | PR CITR.MSFC.FY26.Q4.0092

STATEMENT OF WORK

AI ENTERPRISE SELF-HOSTED APPLICATION

AI Observability Platform & AI Gateway — Implementation, Deployment & Premium Support

NASA Marshall Space Flight Center (MSFC)

Prepared for the Office of the Chief Financial Officer (OCFO) PR Reference: CITR.MSFC.FY26.Q4.0092

Order Schedule No.: 08072601

Quote No.: Q-26072602

Effective Date: July 14, 2026

Date Prepared: July 31, 2026

Table of Contents

(Right-click and select "Update Field" in Microsoft Word to populate page numbers.)

I. Background NASA Marshall Space Flight Center (MSFC), Office of the Chief Information Officer (OCIO), operates the Ask Sage artificial intelligence and machine learning platform in support of MSFC's agency AI/ML objectives.

To mature the observability and governance of this platform, MSFC requires an integrated telemetry and AI gateway solution capable of ingesting logs, traces, and metrics using open standards (OpenTelemetry) while centrally governing access to large language model (LLM) providers.

Per the Recommendation and Determination to Solicit from One Source (RDSS), market research identified only two vendors offering a combined AI gateway and OpenTelemetry-based observability service as a single package. Of the two, the Contractor's API key management approach is the only one that aligns with NASA's zero-trust architecture objectives, allowing the Agency to eliminate the storage and handling of LLM provider API keys directly within its applications — a practice that otherwise poses a significant risk to the Agency.

Accordingly, this requirement was solicited from the Contractor on a sole-source basis, as documented on NF 1707 and its supplement.

This Statement of Work (SOW) documents the scope, deliverables, roles and responsibilities, service levels, and pricing for the implementation and ongoing support of the “AI Enterprise Self-Hosted Application,” inclusive of the AI Gateway, to support MSFC's AI/ML observability and governance objectives.

II. Scope of Work The Contractor (“Provider”) shall provide the AI Enterprise Self-Hosted Application software solution, inclusive of the AI Gateway, together with professional services consisting of installation, configuration, and premium support, deployed within the Government's (“Customer”) private cloud or data center environment.

The Provider shall assist and support the Customer with the following objectives:

• Setup & Initial Configuration of the AI Enterprise Self-Hosted Application in the Customer's private cloud or data center environment.

• Rollout to production to achieve ongoing telemetry ingestion, storage, and observability at scale.

This effort is governed by the Master License and Services Agreement (“MLA”) between the Parties, the Order Schedule (No. 08072601), and the Service Level Addendum (“SLA”) referenced in Section VIII below.

In the event of a conflict between this SOW and the Order Schedule, the Order Schedule shall control with respect to the specific products, services, and fees described therein.

III. System Capabilities The Solution provided under this SOW shall, at a minimum:

1. Supports ingestion, storage, and retrieval of logs, spans, metrics, and distributed traces using open standards protocols compatible with OpenTelemetry.

2. Stores data utilizing object storage with SQL querying capabilities.

3. Provides real-time and historical (within an agreed retention period) analytics, correlation, and visualization across logs, spans, metrics, and traces.

4. Offers customizable dashboards with support for SQL-based visualizations.

5. Provides configurable alert rules based on metrics thresholds and SQL queries, with email and webhook notification channels.

6. Implements a hierarchical organization structure with organization-level roles (admin, member, guest) and project-level roles (admin, member).

7. Enables environment-based data segregation (e.g., production, staging, development) with UI filtering, instrumented via SDKs.

8. Supports federated authentication via multiple identity providers.

9. Provides support for multiple programming languages and frameworks (including .NET, Python, Rust, Go, and TypeScript) through standard and enhanced OpenTelemetry instrumentation.

10. Deploys on the Customer's self-hosted Kubernetes environment via Helm chart for on-premises installation.

11. Includes LLM-specific tracing, capturing inputs, outputs, and metadata (via the included AI Gateway).

12. Supports online and offline evaluations (evals).

IV. Phased Approach, Deliverables, and Timeline This Order Schedule commences on the Effective Date (July 14, 2026) and continues through completion of the Production Phase, unless terminated earlier pursuant to the MLA.

Phase Duration Outcomes / Deliverables

Setup, Testing & Configuration 14-Jul-2026 – 26-Jul-2026

Helm chart and secrets delivered; assisted installation. No usage-based fees are incurred during this phase.

Production Phase 27-Jul-2026 – 27-Jul-2027 Assistance running the Application in production;

configuration tuning; premium support. Fees apply as described in Section IX (Payment Terms).

Deliverables

• Helm chart and deployment secrets for self-hosted installation.

• Assisted installation and initial configuration of the AI Enterprise Self-Hosted Application, inclusive of the AI Gateway, in the Customer's private cloud or data center environment.

• Documentation, including user guides, release notes, and integration instructions (see Section VI).

• Ongoing premium support throughout the Production Phase, per the Service Level Addendum (Section

VIII).

V. Acceptance Criteria Each phase (Setup & Configuration; Production Phase) will be deemed complete once the outcomes listed for that phase in Section IV are met and the Customer provides written confirmation of acceptance (email or Slack are acceptable methods of confirmation).

VI. Contractor (Provider) Roles and Responsibilities

Software Deployment and Configuration The Provider will assist with initial installation and configuration of the Application in the Customer's on-premises or private cloud environment.

Knowledge Transfer & Documentation

The Provider will supply relevant documentation, including user guides, release notes, and integration instructions.

Premium Support

• Email/Slack support within the agreed-upon support window (specified in the Service Level Addendum, Section VIII).

• Assistance with updates, upgrades, patches, and troubleshooting.

VII. Government (Customer) Responsibilities

Environment Readiness The Customer is responsible for ensuring hardware, network, and operating systems meet the requirements outlined in the Provider's Documentation.

Access and Cooperation The Customer shall reasonably cooperate with the Provider by making available the information, personnel, and resources necessary for the Provider to perform the services. Support and assistance will be provided remotely, with the Customer facilitating the exchange of relevant information (e.g., configuration details) as needed. The Customer agrees to report aggregated, anonymous usage (logs/spans/metrics) monthly or upon request. All information and data sharing under this SOW shall be conducted in accordance with the Customer's policies governing International Traffic in Arms Regulations (ITAR) and Controlled Unclassified Information (CUI).

Timely Feedback The Customer will promptly review outcomes, provide feedback, and sign off on deliverables to avoid project delays.

VIII. Service Level Requirements Support for the Solution is governed by the Service Level Addendum (SLA) to the Master License and Services Agreement. A summary of key service levels is provided below; the full SLA is incorporated by reference and controls in the event of any conflict with this summary.

Support Availability and Channels Support Hours Support Channels

P0–P1 Issues: 24/7 (on-call service) Private Slack, Email

P2–P3 Issues: 9 a.m.–5 p.m., Monday–Friday Private Slack, Email

Severity, Response, and Resolution Times

Severity Definition Response Time Resolution Target

P0 (Critical) Complete failure of telemetry data ingestion or a critical security vulnerability; business operations severely impacted.

15 minutes 4 hours

Severity Definition Response Time Resolution Target

P1 (High)

Significant core functionality impaired;

operations continue in a restricted fashion.

Adequate long-term workaround not available.

1 business hour 24 hours

P2 (Medium) System function not operating as designed;

limited or minor impact; workaround available.

1 business day 10 business days

P3 (Low) Minor issue with minimal impact; questions, feature requests, or documentation issues. 3 business days Next release cycle

Technical Support Services Included

• Observability best practices

• Instrumentation (SDK/OpenTelemetry) support

• Infrastructure setup guidance

• Dashboards & alerts configuration assistance

• Query tuning

• Ongoing infrastructure tuning

Service Credits If the Provider fails to meet the Response Time for more than two (2) P0 or P1 incidents in a calendar month, the Customer may request a service credit of 30% of that month's usage fee, per the process and limitations described in the SLA (Section 7).

Support Exclusions The SLA does not cover issues arising from use inconsistent with Documentation, failure to implement recommended updates, third-party software/hardware/network issues outside the Provider's control, infrastructure failures in the Customer's environment, improper installation or configuration, or delays caused by lack of timely Customer access, credentials, or diagnostic data.

IX. Payment Terms

• License fees: invoiced annually in advance upon execution of the Order Schedule.

• Usage overages: invoiced quarterly in arrears.

• Payment terms: Net 30 days from invoice date.

• Excluded costs: private cloud hosting/infrastructure costs are the Customer's responsibility.

• Instance limitation: Customer is licensed to deploy up to one (1) Application instance; additional instances require a written change order.

X. Period and Place of Performance

Period of Performance The period of performance is twelve (12) months, effective July 14, 2026 through completion of the Production Phase on July 27, 2027, consistent with the phased timeline in Section IV, unless terminated earlier pursuant to the MLA.

Place of Performance Support and professional services will be delivered remotely by the Provider. The Solution will be deployed within the Customer's self-hosted Kubernetes environment at NASA Marshall Space Flight Center (MSFC), Huntsville, Alabama.

XI. Change Management

• Any modifications to scope, outcomes, or timeline shall be handled via a written change order signed by both Parties.

• Changes may be subject to additional fees if they substantially alter the nature or scope of the Provider's work.

XI. Change Management