The short version

Running an agent on infrastructure you control does not by itself answer every data-location question. Review the execution environment, stored artifacts, information sent for inference, and operational responsibility as distinct boundaries.

Two planes, four questions

The execution plane is where commands run, repositories are checked out, files change, and local services are reached. The inference plane is where the model receives prompts and the relevant results it needs to reason.

Turn that distinction into four questions:

  1. Execution: Where do commands and tools run?
  2. Storage: Where do source files, outputs, credentials, and artifacts remain?
  3. Inference: Which prompts, responses, and tool results are sent to the model service?
  4. Operations: Who maintains runners, images, access controls, scaling, and incident response?

Architecture labels are too broad when they collapse these questions into one answer.

Practical example

Consider an agent that investigates failed internal builds. Its runner can live inside the company network with access to a repository, package registry, and build logs. Source checkouts and generated artifacts can remain in that environment. The model still needs selected context to diagnose the failure, so the team must decide what tool output may cross the inference boundary.

The organization also owns the operational work created by this design: image maintenance, monitoring, capacity, permissions, and recovery.

Better review practice

Draw a boundary map before approval. Follow each data type from origin to storage, into model context, and back into outputs. Apply minimization to the inference path instead of assuming that network location alone provides the desired protection.

Useful controls

  • Restrict the runner to the systems required for its task.
  • Keep credentials out of prompts and model-visible output.
  • Reduce logs and file excerpts to the evidence needed for reasoning.
  • Define transcript retention and access expectations.
  • Assign an operating owner for updates and incidents.

Try it

Choose one agent workflow and complete the four-boundary map. Name one data category that should remain local, one that may enter model context in reduced form, and the person or team accountable for the runner.