Running an AI agent on your own infrastructure gives you control over deployment and data, but it does not automatically make the system reliable or safe.
The difficult part begins when an agent can use tools, access business context, and continue working after the first prompt. At that point, the system needs operational boundaries—not only a model endpoint and a collection of tools.
Here are seven boundaries worth designing before adding more agents.
1. Give each workspace a clear goal
Do not use one global agent context for every project. A workspace should have a defined goal, its own relevant knowledge, and an explicit set of participants and capabilities.
A measurable goal also gives the system a way to decide whether work is complete. “Help with marketing” is too broad. “Produce a reviewed launch brief and a seven-day content plan” can be checked.
2. Separate agent identity from user identity
An agent should not silently inherit every permission of the person running it.
Use a distinct identity or capability set for each agent role. A research agent may read approved sources but should not publish. A communications agent may draft a message but require approval before sending it. Credentials should be scoped to the smallest useful surface.
3. Treat tools as capabilities, not plugins
A tool description is part of the security boundary. Record what the tool can read, what it can change, and whether the action is reversible.
This is particularly important for MCP servers. Treat MCP configuration like executable dependency metadata:
- allowlist server origins;
- pin the expected package, version, or image digest;
- isolate credentials per server;
- review tool-schema changes;
- default new capabilities to disabled or read-only;
- require approval when capabilities expand.
The question is not only whether a server is trusted. It is what the server can do with the identity and environment available to it.
4. Distinguish planning from execution
The output of a planning step should not automatically authorize execution.
Plans can be reviewed, changed, and rejected. Execution should use a specific plan version and record each attempted step. This makes failures easier to reproduce and prevents the system from quietly changing its approach after approval.
5. Make approval requests inspectable
An approval request should contain a compact decision packet:
- proposed action;
- reason for the action;
- target account or resource;
- important parameters;
- expected effect;
- rollback or recovery path, when one exists.
Users should not need to inspect a full agent transcript to understand what they are approving.
6. Store artifacts separately from chat
A final answer is not always the result of the work. The result may be a document, spreadsheet, code change, report, or updated task state.
Store those artifacts as durable objects, link them to the task that produced them, and keep the supporting evidence available. This gives users something concrete to verify and reuse.
7. Define completion with observable checks
Agents are good at producing plausible completion reports. They still need objective acceptance criteria.
Examples include:
- a command exits successfully;
- an expected file exists and passes validation;
- a message remains in draft until approved;
- a workflow creates the expected artifact;
- a required source is cited;
- a human reviewer accepts the result.
Without these checks, “done” is only another model-generated sentence.
A small reference model
The resulting loop is straightforward:
Goal
-> Workspace context
-> Plan
-> Task steps
-> Tool calls
-> Approval when required
-> Artifact
-> Acceptance check
We use this operating model in Manor AI, a self-hosted AI workspace for connecting conversations to persistent work. The public repository is source-available under the Sustainable Use License 1.0.
Self-hosting is most valuable when it gives operators understandable control. The architecture should make the agent’s scope, actions, and results easier to inspect—not merely move the same black box onto another machine.
Top comments (0)