Self-hosted or hosted governance

The first question is who holds the payloads. An inline governance layer reads every prompt, every tool argument and every tool result, because that is what it means to decide whether they may proceed. If it runs somewhere you do not control, a copy of the most sensitive traffic in your organisation crosses a boundary before any control has decided whether it should have. That is not automatically wrong — plenty of organisations put customer data through hosted services deliberately and with a contract behind it — but it is a decision to make with your data protection officer in the room, not one to arrive at because a hosted deployment was quicker.

The second is who can rewrite the evidence. Governance evidence exists to answer questions about your organisation’s behaviour, which means the interesting adversary is an insider. If the record lives with the vendor, you have moved the threat from your administrators to theirs and gained a party who can be compelled, acquired or breached independently of you. If it lives with you, the record is protected against the vendor and exposed to your own database administrators, which is exactly the threat that keyed digests and off-box anchoring exist to address. Neither arrangement removes the problem; they relocate it, and the honest question is which relocation you can actually manage.

The third is what happens when the control plane is unavailable, and it is the one that catches teams out. A control that refuses when it cannot decide is a dependency of every agent that routes through it. Self-hosting makes that dependency yours to engineer, which is better than it being someone else’s to engineer without telling you — but only if you actually engineer it. The concrete artefact is a written answer to what happens when the fail-closed gateway is down: agents stop, or a named person makes a decision under a documented procedure. Token Observe’s own design-partner gate lists exactly that as an item that must have an owner before traffic flows.

Notice that none of the three is about trust in the abstract. They are about custody, adversary and dependency, and each has a checkable answer.

Single node is the baseline: one container, a mounted volume, a reverse proxy in front. It suits one control plane serving a whole organisation at the scale this design targets, and the cost is that the write path is one process by design.

Hybrid inside your own cloud network is the same artefact with different egress. Nothing about the image changes — only where it runs and which destinations it is allowed to reach — and payloads leave only to the model providers you explicitly enabled. The proxy in front has real requirements rather than nominal ones: it terminates TLS, it must not buffer responses or streaming breaks, it preserves the authorisation headers, it is the only thing setting the forwarded-for headers, and its read timeout is at least as long as your longest model response.

Air-gapped works, with two things to plan. Prices load from a shipped catalogue at boot so an install is metered from the first request without reaching anything, and the refresh path — the one optional call to a public catalogue — simply never runs. Providers point at internal endpoints instead: a self-hosted inference server, a cloud model service through a private endpoint. Building the image from source still needs the base image and package registries, so mirror those or import a verified release image before disconnecting.

A platform-as-a-service deployment is single node with someone else’s volume and edge, and it carries defects configuration cannot fix. Token Observe names three for that shape: an unauthenticated metrics endpoint on a public hostname, deploy-time-only health checks that make its readiness gate inert, and platform volume snapshots that bypass its restore tooling. There is also a trap worth knowing before you meet it, which is that the audit key ceremonies are designed to boot deliberately unready for their entire life, so a platform that gates deploys on a readiness endpoint will mark them failed and roll them back.

Across all four, two destinations are worth configuring regardless of shape: an authenticated receiver for signed audit anchors, so the evidence about your chain lives somewhere other than the database it attests, and encrypted off-box backups. Both are the same argument — a record held only by the party under examination is worth less than a copy somebody else is holding.

Backups and a restore drill you have actually run. A retained full snapshot is not point-in-time recovery, and the obvious success criterion — the process starts — is not the criterion that matters. What matters is that the restored evidence chain verifies against a head you recorded outside the system, because a restore that lost its tail also lost the attestation of that tail and will verify clean against its own stored state.

Key custody, and two ceremonies. Keying the audit digests means injecting a key from a secret manager your database administrators cannot read, and Token Observe requires a two-boot ceremony with an external one-shot flag to enable it and another to rotate it, precisely so that database rows cannot silently invent an epoch. Signing anchors means holding an Ed25519 private key in a key management service and distributing the public half out of band. Both are forward-looking guarantees, so the cost of postponing them is a permanently weaker prefix of history.

Retention as a decision. Token Observe’s trace retention is unset by default and unset means keep forever, which over-satisfies a minimum-retention duty and satisfies no storage-limitation duty at all. Somebody has to choose a period, and somebody with a legal qualification has to say whether the obligation applies. That is a decision self-hosting hands you along with the disk it fills.

And the residual risks, accepted in writing rather than assumed away. Token Observe’s own commercial-readiness document lists what a customer would be accepting: a single-node deployment on an embedded database, no vendor-operated service level, no independent certification, and an endpoint-seat surface published as preview. It also states that its licence is a template drafted by the engineering team pending review by counsel, that no independent penetration test has been carried out, and that it holds no SOC 2 report and no ISO certification. Those are the sentences to look for in any vendor’s material, and their absence is more informative than their content.