Yes, in most designs, though "your own infrastructure" can mean different things for different parts. The enforcement point must sit in the path of every agent action, close to your systems. The record must be tamper-evident. The model can run somewhere else entirely. Decide each part on its own merits rather than all or nothing.
Which parts of an agentic operating system can you host?
An agentic operating system is not one box. It has parts with different needs, and each can sit in a different place.
- The enforcement point checks each proposed action against the agent's bounds and returns a verdict. It has to sit between agents and your systems, so it usually runs close to them.
- The policy and certificate store holds roles, depths, limits and certificate status. It must be available whenever an action is checked.
- The record holds every verdict, append-only. It holds sensitive data, so its location is often what data protection teams care about most.
- Certification runs replay agents against your past cases. They need compute and access to those cases.
- The models may be hosted by a model provider or run on your own hardware. They are separate from the operating system.
Because of that last point, a business can run the whole governing layer in its own network and still call a hosted model, or the reverse. The model is not its own supervisor, a point argued in why the model cannot be its own supervisor, and nothing about governance requires them to live together.
What are the trade-offs of each option?
| Option | You gain | You take on |
|---|---|---|
| Fully vendor-hosted | Fastest start; vendor runs updates and availability | Data leaves your network; you rely on the vendor's controls and attestations |
| In your own cloud tenancy | Data stays in your environment; your network rules apply | Running and patching the software; capacity for certification runs |
| On your own premises | Maximum control over data location | Hardware, availability, and keeping platform guardrails up to date |
| Split: enforcement and record yours, management hosted | Sensitive data stays local; vendor still runs updates | More moving parts and a clear agreement on who operates what |
None of these is right for every business. A bank with strict data residency rules may keep the record and enforcement in-house. A smaller firm may prefer a hosted service with strong attestations. Under DORA, an EU financial entity treats a hosted provider as an ICT third party either way.
What does the platform layer have to do wherever it runs?
Hosting location does not change the job. The layer must still:
- Sit in the path of every action, so no agent can reach a system of record without a verdict.
- Fail closed: if the enforcement point is unavailable, actions wait rather than proceed unchecked.
- Keep the record append-only and tamper-evident, with integrity you can demonstrate to an auditor.
- Receive updates to platform guardrails, including the withheld actions that apply to every agent.
- Run certification on your cases and lapse certificates on time.
The gap that self-hosting most often opens is the last two. A disconnected installation that misses guardrail updates, or whose certificate expiry depends on someone remembering, is weaker than it looks.
What does this look like for a regulated firm?
Take a mid-sized insurer that wants claim files to stay in its own cloud tenancy. It runs the enforcement point and the record there, next to its policy administration and claims systems. Its claims agents call a hosted model for drafting, sending only the minimum facts each task needs. Certification runs on the insurer's own past claims, inside the tenancy.
When the insurer adds a new AI agent, nothing about the process changes because of where it runs. The agent gets a role, its connections are registered, it is certified and it starts at a low depth.
What stays with a person?
Hosting choices are made by people, not by the platform: data protection owners decide where records may sit; risk owners decide whether a hosted model is acceptable; operations teams own availability and patching. Approval of held actions stays with named people whatever the deployment.
The difference from an AI gateway, which also often runs in your network, is set out in whether an agentic operating system is the same as an AI gateway. The full set of jobs the layer has to do is in the governed agentic operating system guide.
Questions people ask
Does running it yourself make you compliant?
No. Location is one control among many. You still need limits, approvals, certification and a record that holds up to scrutiny, wherever the software runs.
Can the model run on our hardware too?
Often, if you choose an open-weight model and have the capacity. That is a separate decision from hosting the governing layer, and the model still needs certifying on your cases.
What happens if the self-hosted enforcement point goes down?
It should fail closed, so agents stop acting rather than act unchecked. Plan for its availability the way you would for any system that sits in front of your systems of record.