Hybrid Agentic Work: Self-Hosted and Cloud Models for Sensitive Information

All courses / AI Platform and Security / Module 3 / Chapter 15

Learning objectives

After the lesson the participant can:

• Explain why model routing for an agent is decided per workspace before the session starts and never per prompt.
• Classify work into the four information classes and assign the permitted model tier and workspace to each.
• Design the controls outside the client that make classification routing enforceable.
• Plan the evaluation that decides whether a protected workspace offers full agents or planning and review only.

Key concepts

Routing before the session starts

An agent sends file contents, command output, tool results and its earlier turns to the selected model. Once a cloud session has read a protected file the disclosure has happened, so the workspace's classification fixes the model tier in advance.

Information classes

Public, internal, confidential and protected. Confidential work may use a cloud service that has passed the controls guide for that class; protected work, such as Article 9 personal data and trade secrets, admits only a self-hosted model in an isolated zone.

Label the work, not the user

Every repository and data set carries a class, unlabelled work defaults to confidential, and labels are bound to the source-control platform and workspace identity, so that the gateway never trusts what the client asserts.

Enforcement outside the client

A client setting is a convenience, not a control. Direct egress from agent workspaces is denied, model traffic goes only to the AI gateway, cloud keys live only in the gateway and a protected workspace holds no cloud credentials at all.

Capacity follows context

A session resends its growing history at each step, so context memory, not the number of engineers, limits concurrency on the self-hosted tier. The tier is sized from measured pilot sessions, and sessions are queued instead of truncated.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The line between Mode 3 and Mode 5 is said to be not the tool but whether a person is present to answer a prompt. Which of your agent runs already have no person present?
2. Where a local model falls short, the chapter restricts the protected workspace to planning and review agents instead of relaxing its routing. How would your engineers react, and what would you say to them?
3. Nordvik Region's hybrid is narrow by necessity and Hansa Mutual's broad by design. What decides the right breadth of the protected tier for your organisation?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Why must the model tier for an agent session be decided before the session starts?

   1. Because switching models during a session resends the whole history and so doubles the token cost of every later step
   2. Because self-hosted models cannot continue a history begun by a cloud model
   3. Because once a cloud session has read a protected file the disclosure has happened; switching model does not recall it
   4. Because the AI Act requires a deployer to register the model before each session
   Show the answer

   C. Because once a cloud session has read a protected file the disclosure has happened; switching model does not recall it
   The agent sends whatever context it gathers to the selected model, and a compacted history carries it forward, so routing follows the workspace's classification, never the prompt.

2. What does the chapter say about a client setting that selects the permitted model provider?

   1. It is sufficient once the managed configuration file sits in the administrator-only directory of the workspace image
   2. It is a convenience, not a control, because a user can install another client or supply a cloud key
   3. It should be replaced by a written instruction to engineers in the acceptable-use policy
   4. It is the place where refused requests are logged as evidence
   Show the answer

   B. It is a convenience, not a control, because a user can install another client or supply a cloud key
   The gateway and the network policy carry the control: even with a replaced client, the protected workspace has no route or credential for a cloud model.

3. What is the practical guide's default treatment of a repository that carries no classification label?

   1. It counts as public until the information owner says otherwise
   2. It counts as internal and may be opened in a standard workspace
   3. It counts as protected and may be read only without any agent
   4. It counts as confidential, and agent access to unlabelled repositories is refused
   Show the answer

   D. It counts as confidential, and agent access to unlabelled repositories is refused
   The guide says to classify the work, not the user, to refuse agent access to unlabelled repositories and data sets, and to default unlabelled work to confidential.