Start with trust boundaries
The first architecture question is not which model to use. It is which component may receive messages, hold credentials, read files, call tools, retain memory, and approve high-impact actions.
A five-layer model
- Channels: messaging, email, web, voice, CRM, and scheduled triggers.
- Host control plane: identity, routing, secrets, policy, sessions, memory, and lifecycle.
- Execution environment: the model or agent runtime operating inside a bounded workspace.
- Tools and data: APIs, MCP servers, databases, files, and business platforms.
- Delivery and observation: output validation, logs, retries, approvals, and monitoring.
Container isolation is not the whole security model
Containers help separate files and processes, but they do not automatically prevent unsafe network access, secret leakage, prompt injection, excessive permissions, or vulnerable dependencies. Production design still needs explicit mounts, network policy, secret handling, tool allowlists, updates, and review.
Memory needs governance
Long-term memory can preserve preferences, prior decisions, and workflow context. It can also preserve inaccurate or sensitive information. Retention rules, user boundaries, deletion paths, and reviewable summaries belong in the design.
Operational readiness
A self-hosted agent should have health checks, restart policies, backups, versioned configuration, audit records, cost visibility, and a human escalation route. If those parts are missing, the system is still a prototype regardless of model quality.