The AI agent hosting guide starts one step earlier by separating the model endpoint, runtime, state, tools, and control plane. For the connected-system control path, see the AI agent integration guide.
My editorial verdict: I would reject any shortlist that says only “SaaS,” “private cloud,” or “self-hosted.” Those labels are useful starting points, but a buyer needs the component map before making a decision.
What does an AI agent platform include?
For this buying decision, an AI agent platform is the layer that manages the runtime, files, model calls, permissions, and activity records. This definition helps buyers review deployment boundaries. It does not claim that every vendor uses the phrase in the same way.
Start with the work the platform must support. Write down the records the agent may read, the actions it may request, and the systems it may call. Then identify the components that make that work possible:
- The runtime and orchestrator hold workflow and routing logic.
- Files and working storage hold state, memory, prompts, or outputs required by the workflow.
- Model endpoints receive the inputs sent for inference.
- Permissions and connected tools determine which business systems and credentials the workflow can use.
- Logs and telemetry record selected events or operating data.
- Backups and recovery cover whichever components the agreed scope includes.
- Operator access lets named people or services administer the system.
- Subprocessors are outside parties used in the supplied service chain.
The list is a recommended review structure. It does not assert that every platform implements each item in the same way. For a deeper ownership view, use the box-versus-SaaS guide beside the private AI boundary guide.
What does “private cloud AI agent” actually mean?
A private cloud AI agent is not always a private data path from end to end. IBM describes private cloud as a cloud environment reserved for one customer. IBM calls it single-tenant. IBM also says that a third party manages the infrastructure in a managed private cloud (IBM private cloud). That tells a buyer something about tenancy. It does not locate the agent’s external model request, CRM connection, telemetry destination, backup target, support route, or every subprocessor.
Hybrid is also a component decision. IBM defines hybrid cloud as a combination of public cloud, private cloud, and on-premises infrastructure (IBM hybrid cloud). An agent platform can therefore use a dedicated orchestrator while routing selected work to an outside model or connected application. The correct description is the recorded path, not the broadest label in the proposal.
Ask the seller or operator for a diagram that answers:
- Which component receives the original instruction?
- Which component stores working state and final output?
- Which model endpoint receives content from the workflow?
- Which connected tools receive queries or actions?
- Where do logs, telemetry, and backups go?
- Who can obtain operator access, including support access?
- Which subprocessors participate in those paths?
Boundary callout: Treat “private” as a tenancy statement until the component diagram shows what remains inside, what crosses the boundary, and who operates both sides.
How do SaaS, managed private cloud, and self-hosting differ?
The useful difference is the assignment of each component and operating duty. The matrix below is a buyer worksheet, not a universal description of products. “Confirm” means the answer must come from the current architecture, contract, or operating record for the candidate.
| Ownership question | Shared SaaS | Managed single-tenant, BYOC, or private cloud | Self-hosted or on-premises |
|---|---|---|---|
| Runtime operation. | Name the provider team that runs the service. Name the customer owner who oversees the tenant. | Name the provider or cloud team that runs the environment. Name the customer owner who oversees the runtime. | Name the internal or hired operator that runs the host and platform. |
| Files, export, and deletion. | Name the provider owner for storage, retention, export, and deletion. Name the customer data owner who approves requests. | Name the provider and customer owners. Cover dedicated and shared storage, retention, export, and deletion. | Name the storage operator and customer data owner. Cover retention, export, and deletion. |
| Model endpoints. | Name the provider owner who lists the endpoints. Name the customer owner who approves them. | Name the owner of included and external endpoints. Name the customer owner who approves them. | Name the operator who sets up endpoints. Name the customer owner who approves them. |
| Permissions and connected tools. | Name the provider and customer admins who grant and revoke platform and connector access. Name the credential owner. | Name the customer, provider, and support admins who grant and revoke each access path. Name the credential owner. | Name the admins who grant and revoke access. Name the owner of each credential. |
| Logs and telemetry. | Name the provider owner who controls log access and retention. Name the customer owner who reviews the logs. | Name the provider and customer owners for access and retention. Cover tenant logs and provider telemetry. | Name the log admin who controls access and retention. Name the owner who reviews the logs. |
| Backups and recovery. | Name the provider restore owner. Name the customer owner who checks backup scope and recovery tests. | Name the provider and customer owners for backups, restores, and recovery tests. | Name the backup and restore operator. Name the owner who plans and reviews recovery tests. |
| Operator access. | Name the provider and customer admins. Name the owner who reviews support access. | Name the customer, provider, and support admins. Name the owner who reviews their roles. | Name the admins and any support route. Name the owner who reviews access. |
| Subprocessors. | Name the provider owner who keeps the service list. Name the customer owner who reviews it. | Name the owners who review providers on both sides of the deployment boundary. | Name the operator owner who records outside services. Name the customer owner who reviews them. |
IBM notes that on-premises private cloud leaves the organization in charge of its data-center operation and security measures, while managed private cloud outsources infrastructure management to a third party (IBM private cloud). That supports a responsibility distinction, not a blanket verdict about either model.
Use the matrix in procurement notes. For each cell, add an owner, evidence link, review date, and unresolved question. A blank cell is not evidence that the component stays inside the chosen boundary.
Who should own runtime, files, permissions, logs, and recovery?
Every operating duty needs a named owner before the firm selects a platform. IBM lists cost and management demands among private-cloud drawbacks. These include hardware, software, and possible staffing needs. IBM also says that the organization must manage an on-premises private cloud (IBM private cloud). These are IBM’s general cloud notes, not a cost estimate for an AI agent platform.
For an agent deployment, turn that general warning into questions rather than assumptions:
- Who applies platform and host updates?
- Who reviews failed runs and access changes?
- Who tests the restore procedure for the agreed backup scope?
- Who rotates platform and connector credentials?
- Who changes the map when a model, tool, or support provider changes?
- Which duties remain with a managed provider, and which remain with the firm?
The same questions belong in a managed proposal. A separate tenant does not name the person who handles recovery, and infrastructure ownership does not document every external connection. These are recommendations for due diligence, not claims about the behavior of a particular vendor.
How should risk governance and access control shape the choice?
Use governance frameworks to shape questions. Do not treat them as a product endorsement or security guarantee. NIST says that use of its AI Risk Management Framework is voluntary. The framework helps organizations consider trustworthiness in the design, development, use, and review of AI systems (NIST AI RMF). A buyer can use that approach to record the use case, affected records, responsible people, evidence, and review decisions.
NIST SP 800-207 says zero trust removes implicit trust based only on network location or asset ownership and focuses on protecting resources rather than network segments (NIST SP 800-207). Applied as a design principle, that means a “private network” label should not end the access review. Ask which identity requests access, which resource it reaches, what policy applies, and what evidence is retained. The publication does not establish that any named platform is secure or compliant.
Governance callout: A framework can improve the questions and records around a decision. It cannot replace evidence from the selected architecture, contract, and operating procedure.
What does self-hosting n8n prove about the boundary?
Self-hosting proves where the n8n instance runs. It does not locate every model, tool, log, or backup used by a workflow. n8n says that users can host it on their own infrastructure, on-premises, or in a private cloud (n8n hosting). Its security guide also lists setup tasks for self-hosted operators. They include security audits, SSL, SSO, limits on nodes and the public API, and redaction of execution data (n8n security). These are n8n’s own hosting and setup statements, not proof about a specific deployment.
If n8n is on the shortlist, attach the same boundary matrix to one representative workflow. Record its credential owner, model endpoint, connected application, execution-data setting, log destination, backup scope, and administrator. The open-source AI agent platform guide adds a separate ownership test for code, configuration, data, and operations.
How should a boutique firm choose an AI agent platform?
Choose the candidate whose documented boundary matches the firm’s workload and whose operating duties all have named owners. Apply the same ownership worksheet to every candidate and compare the completed records.
Use this short decision sequence:
- Select one representative workflow and list the records and actions it needs.
- Complete every row of the boundary matrix for each candidate.
- Mark every external model, tool, telemetry route, backup target, support path, and subprocessor.
- Assign a firm owner and an operator to each unresolved duty.
- Compare the completed maps, not the deployment labels.
If shared SaaS produces an acceptable documented path, keep it on the shortlist. If the firm needs an assigned environment with provider operation, examine managed single-tenant, BYOC, or private-cloud terms. If the firm wants to control the host, examine self-hosted or on-premises options and name the operator. These are conditional recommendations, not claims that one model is safer, cheaper, or faster.
FAQ
Is a private cloud AI agent fully private?
Not from the label alone. IBM’s definition supports dedicated, single-customer tenancy, but an agent may still use external model endpoints, connected tools, telemetry, backups, support access, or subprocessors (IBM private cloud). Review each component.
What are the downsides of private cloud?
IBM identifies cost and management demands among general private-cloud disadvantages and describes the organization’s operating role for on-premises private cloud (IBM private cloud). For an agent platform, ask who owns updates, access, logs, backups, recovery, and changes to outside connections.
How should a boutique firm choose an AI agent platform?
Choose by documented fit: complete the same ownership map for each candidate, record evidence, and assign every operating duty before comparing the completed records.
Does zero trust make a private AI agent platform secure?
No such conclusion follows from NIST SP 800-207. The publication provides zero-trust principles, including removing implicit trust based only on network location or asset ownership; it does not certify a product (NIST SP 800-207).