Guide · · By Vanta
The risk with an autonomous AI agent isn't that it gives a wrong answer. It's that it takes a wrong action — sends an email, deletes a file, pushes code, spends money — that you never approved and might not even notice. As agents get more capable and more autonomous, "governance" stops being a buzzword and becomes the thing that lets you leave one running at all.
Here's a practical model for containing an agent, and why it belongs on your own machine.
Answers are reversible. Actions aren't. #
A bad paragraph costs you nothing — you read it, you discard it. A bad action can be irreversible: an email is sent, a bucket is deleted, a transaction clears. So governance should focus its strictness where the stakes are: the moment the agent tries to change something outside itself.
The containment primitives #
Least privilege, deny by default. The agent gets access to exactly what the task needs and nothing else. A file-summarizing agent has no business reaching your SSH keys because a prompt told it to.Outbound gating. Every side-effect that leaves the machine — email, HTTP write, upload, publish, push — passes through an explicit approval gate. The model canproposethe action; it doesn't get tofireit unilaterally.Secret hygiene. Credentials never land in a transcript or a log. The instant a secret is written somewhere readable, treat it as compromised.A tamper-evident audit trail. You need to answer "what did this thing actually do?" from a record the agent can't quietly edit — not from the agent's own summary of itself.A kill switch. One action stops everything, cleanly, without corrupting state.
Why local-first matters here #
Governance you don't control isn't governance. If the gate, the audit log, and the policy all live in a vendor's cloud, then "the agent is contained" is a promise someone else is making about their own product. Running the control plane on your own machine means the containment is yours: you can inspect it, you can't be silently opted out of it, and it keeps working with the network unplugged.
There's a subtle trap, too: many "local" agent tools run the model locally but keep telemetry, sync, or a hosted control loop phoning home. If the governance layer isn't also local, the containment has a hole in it.
Where Aviary fits #
We built Aviary as a local-first governance suite for exactly this: scoped access, outbound gating, secret protection, and an audit trail — all on your machine, enforced rather than suggested. The design goal is simple to state and hard to earn: an agent should never be able to take an action you didn't approve without you being able to see that it tried.
If you're evaluating agent tooling, that's the question worth asking of any of it — including ours.