On-premise AI agents, and what to check before you run one
An on-premises AI agent runs platform components on customer-controlled infrastructure and uses approved tools against an agreed scope. The model can be local or hosted, so on-premises application hosting does not by itself establish local inference. Evaluate execution policy, evidence and each external dependency before rollout.
Evaluating this for your team? Discuss your use case, deployment boundary and success criteria in a technical briefing.
Book a technical briefingSeparate application hosting from inference
Draw the console, gateway, stores, enrolled hosts and chosen model endpoint. Mark every connection that crosses the approved environment, including licensing, updates and support access.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Review commands and their evidence
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Host investigations show the commands that ran, their exit codes and output, per host.
In automatic-review mode, the classifier assesses command risk and returns approve, deny or escalate, a low, medium, high or unknown risk level, and a rationale. It is a command-risk control, not document classification or DLP.
Assign operating responsibility
- Name the infrastructure, platform, model and identity owners.
- Specify DNS, TLS, permitted network routes and backup handling.
- Agree support access, maintenance and recovery procedures.
- Confirm supported host packages before installation.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
Run a repeatable acceptance test
Test enrolment, permitted reads, denied actions, review behavior, evidence capture and restoration on the agreed release. Treat disconnected operation as a separate acceptance exercise.
Questions buyers ask
What is the first rollout boundary?
Begin with a small, non-production host scope and a named administrator.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Does on-premises mean all data remains local?
Only an accepted design with local processing and reviewed support, logs and backups can establish that boundary. A hosted model receives the context sent to it.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
How is command access governed?
Evaluate the policy on the agreed release and test allowed, denied and review-required actions.
Execution follows the configured host policy. A command can be approved, denied or referred for human review; individual approval depends on that policy.
In automatic-review mode, the classifier assesses command risk and returns approve, deny or escalate, a low, medium, high or unknown risk level, and a rationale. It is a command-risk control, not document classification or DLP.
What identity option is available?
Review identity for the selected deployment rather than assuming the same integration applies everywhere.
Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.
Where to go next
All guidesBring one question of your own.