Two routes to an agent in operations
There is no general answer to whether an AI agent should be hosted or built in-house. For mid-sized companies, though, there is a workable rule. Part 1 of this series looked at what is actually new about OpenAI Dots. Here I set Dots against an agent harness you build yourself.
First, two terms. A hosted agent runs on the vendor's computer, and the vendor handles operations. Dots is one example: according to Engadget, each Dot works on its own cloud computer with a browser. A harness is the environment you build yourself for an agent to work in. It sets the procedures the agent follows, what it remembers and which rules apply to it.
In fairness, you should know that I run a setup like this myself and advise companies on it. So I have a stake in one of the two routes. That is why the weaknesses of a self-built harness are part of this article too.
The comparison across eight axes
The middle column draws on reports from Engadget, TechCrunch and NBC News and on a product analysis by Vellum (secondary sources, no tests of my own). The right-hand column describes my own setup.
| Axis | Dots (hosted) | Your own harness |
|---|---|---|
| Runtime and operations | Hosted computer with a browser at the vendor (Vellum, Engadget). You run nothing yourself. | Own computer that stays switched on around the clock. Operations and maintenance are my job. |
| Triggers | According to OpenAI "always-on" and reachable via Slack and Teams (TechCrunch). Proactive research is read-only, plus scheduled tasks (Vellum). | Scheduled jobs at fixed times. There is hardly any channel through which a job can come back with a question. |
| Memory | ChatGPT memories plus what it learns from conversations and apps, held by the vendor (Vellum). | Readable files under version control. Every change stays traceable, and the content can be taken elsewhere. |
| Procedural knowledge | General assistant that learns from conversations and apps (Vellum). | Own procedures as skills: written work instructions that the agent loads when a task matches. |
| Tools | More than 4,000 apps via plugins (Engadget). Strength: breadth. | Every connection wired up in-house. Less breadth, but closely fitted to my own processes. |
| Approvals | Built-in vendor rules, the user's own rules, a computer the user can watch (Engadget); automatic review when an action affects accounts, and monitoring can pause work (Vellum). | Own permissions, hooks (automatic checks before or after a work step), a log and manual approval before every publication. |
| Models | Fixed to OpenAI's GPT-6 Astra (TechCrunch). | Free choice per task, plus a second opinion from other vendors' models. Every call goes to the vendor of the chosen model. |
| Availability | Pro at launch excludes the EEA, the United Kingdom and Switzerland (Vellum); according to NBC News, not available in Europe and the UK. Business Premium: no explicit regional exclusion stated, situation unclear. | Running today. |
Go through the table with a concrete task from your company. For each axis, ask which of the two answers would bother you.
Where the hosted agent wins
For personal delegation of knowledge work, the hosted agent is the simpler choice: preparing research, sorting appointments, collecting invoices, triggering an order. These are also the examples that come up in the reports on Dots. A small or mid-sized company does not automatically need its own harness for that.
The simpler route still carries a risk. Calendars, inboxes and invoices contain third-party data. The inbox that holds the invoices may also hold job applications, customer complaints and sick notes. Whatever the agent reads there can end up in its memory at the vendor. That hardly matters for market research, but it does for an inbox.
Three things speak for the hosted route. Nobody in your company has to keep a computer running or hunt for failed jobs. Wiring up that many connections (more than 4,000 apps) yourself doesn't pay off for one person's tasks. And the assistant can be reached via Slack and Teams, where your team already communicates.
The limit is memory. According to Vellum, a Dot uses ChatGPT memories and learns from conversations and connected apps. If you disconnect an app, what the Dot has learned stays. A reset deletes conversations, memories and scheduled tasks together. That matters for knowledge that is meant to belong to your company for the long term.
Before you connect a Dot to company accounts, the vendor should answer four questions:
- Where is the data that the Dot stores from conversations and connected apps, and in which region is it processed?
- Which logs show what the Dot did and when?
- Apart from the user, who can view the Dot's computer?
- Does content from conversations and connected apps flow into model training, and can that be switched off?
Where your own harness wins
Your own harness pays off for process-critical workflows: processes where a mistake reaches the outside world, costs money or can no longer be explained later. Four requirements then make the case for your own setup. Approval gates are fixed points where a person has to give consent. An audit trail is a log from which you can later read who decided what, and on what basis. With model choice, you decide which model handles which task. Control over the data flow means you determine where memory and work in progress are stored, which data goes to a model at all, and what is stored for how long.
Your own harness does not automatically give you full data sovereignty, though. Whatever the harness sends to a model goes to that model's vendor, in my setup to vendors based in the US. What you can control is what goes into that call. Procedures, memory and logs stay with me because I run the storage and the computer myself. Processing inside the model stays with the vendor. A vendor location in the EU shortens the route your data takes, but that still falls short of full control. You only get full control with a model you run yourself, on your own or self-managed infrastructure.
My own setup has only a few building blocks. Procedures are written down as skills: which sources count, which steps run in which order, what gets checked. Memory sits in text files under version control, so I can restore any earlier state. Recurring tasks start as scheduled jobs on a computer that runs continuously. Nothing is published without my manual approval. For planning and review I use a powerful model, for simple search and sorting work a smaller one. Important results are also cross-checked by a model from another vendor.
The real difference from the hosted agent lies in the codified procedures. The model underneath can be swapped. How your company handles a task is written down in files you can read, change and check. A hosted agent brings general capabilities. Your own harness carries out your way of working.
One example from my setup is publishing a specialist article:
The same pattern fits many workflows in mid-sized companies: quotes whose prices someone has to approve, binding answers to customers, reports to shareholders. Wherever you will later have to show who approved something and on what basis, there is a strong case for your own harness.
The weaknesses of your own harness
Your own harness takes ongoing attention. Anyone who keeps quiet about that is selling a tinkering project as an operating model. In my setup I see three clear weaknesses.
First, maintenance. Scheduled jobs sometimes fail silently: the computer is running, but a job doesn't fire, and nobody notices until a result is missing. On top of that, skills, rules and memory files grow with every adjustment. Without regular checks they drift apart, and the same rule ends up worded differently in two files. With the hosted agent, the vendor takes on this work.
Second, many rules exist only in the prompt, the work instruction given to the model. Nothing enforces them technically. An agent can overlook them, forget them during a long task or work around them when another instruction seems more plausible. A text instruction is a request. A missing permission is a limit.
Third, there is no back channel. If a scheduled job gets stuck, it aborts or delivers half a result. Dots, by contrast, can be reached via Slack and Teams (TechCrunch). My setup lacks this channel.
The lesson: rules that matter belong in permissions and automatic checks. Anything that exists only as a sentence in the prompt remains a recommendation to the model.
This applies to the hosted agent too. OpenAI itself provides the connection to Part 1: according to The Rundown, in a controlled test of its own, flags for moderate scope violations rose from 8.6% to 19.7% when the number of intervening tasks grew from five to ten. No serious violations were observed. My reading: oversight is work, whether you run the agent yourself or use it through the vendor.
The decision rule for mid-sized companies
The rule has two axes. The first asks about impact: does the task stay with one person, or does its result reach the outside world, cost money or need to be explained later? The second asks about data: does the task touch names, emails or figures belonging to customers, applicants or employees, or confidential company data? Non-critical here means public sources or documents explicitly released for this purpose.
Personal delegation with non-critical data belongs with the hosted agent. Personal tasks with sensitive data only qualify once the vendor has answered the questions on region, retention period, training and access, and the answers suit your company. Process-critical workflows that need approval gates, an audit trail or your own choice of model belong in your own harness, all the more so when sensitive data passes through them. For most companies, a mix of both is the right fit. That is my recommendation. It is not a finding about how common either approach is among mid-sized companies, and it is not a legal assessment.
You decide this for each task. The same company can give its sales team a hosted agent for market research, keep that agent away from the HR inbox and route the workflow that sends quotes to customers through its own harness with manual approval. How tasks can be classified by tier is shown in the 3-tier model for AI agents.
Write down the tasks you want an agent to take over, and answer four questions for each. Who approves: is the person who delegates enough, or does the step need a second approval before anything leaves the company? Which data does the task touch, and where does the vendor process and store it? If it includes data on customers, applicants or employees, settle this question before you start, together with the person responsible for data protection in your company. Who may change the model? According to NBC News, OpenAI held back a newer model for the time being; a hosted agent runs on the vendor's model, and when the vendor changes it, your agent changes with it. And what happens if the job fails: who notices, and who takes over?
If the answers for every task are "the person themselves" and "doesn't matter", the hosted agent is enough. If it has to be settled who approves in addition, who decides on the model or who takes over when a job fails, you are in own-harness territory. If the task touches sensitive data, check before you start whether the vendor's answers are good enough for your company. If they are not, the task stays with a person or moves into your own harness.
Part 3 is about AI transformation in mid-sized companies: who owns which workflow, how do you introduce approval levels, and who runs the whole thing on Monday morning? Part 4 switches perspective and asks what changes when your customers send enquiries or place orders with you through an agent of their own.
Which workflow in your company already needs approval and a log today, and who would notice if an agent skipped a step there? The AI Diagnostic offers a first assessment.
Frequently asked questions
As a mid-sized company, do I need my own harness at all? For many tasks, no. If employees want to hand research or orders to an assistant, a hosted agent covers that. Your own harness pays off for a workflow that needs approval before every step with an external effect, a traceable log, a free choice of model or control over which data goes to which model.
What about inboxes, calendars and invoices? They contain third-party data: names, the content of conversations, bank details. Before you connect accounts like these to a hosted agent, it should be clear in which region the vendor processes the data, how long it stores it, whether it flows into training and who can view it. Whether the answers are good enough for your company is for the person responsible for data protection to decide. This article describes practice and does not replace a legal assessment.
Does my data stay entirely with me in my own harness? Not quite. Procedures, memory and logs can stay with you if you run storage and logging yourself. Whatever your harness sends to a model, though, goes to that model's vendor. You decide which data goes into a call, which vendor gets which task and what is stored for how long. A vendor location in the EU shortens the route your data takes. Processing only stays fully in your hands with a model you run yourself.
Can I combine both? Yes. Non-critical personal tasks then sit with the hosted agent, and the process-critical workflows run in your own setup. Tasks with sensitive data only go to the hosted agent once you have checked the vendor's answers. Decide which data may go into which system: whatever a hosted agent learns is stored by the vendor, and according to Vellum, disconnecting an app does not delete what has already been learned.
How much attention does running my own setup take? More than setting it up would suggest. In my case, jobs fail from time to time, and procedures and rules need constant upkeep. One person should have fixed responsibility for checking regularly that everything ran. That time belongs in the calculation before you decide on your own route.