Self-hosted files and locally executed tools do not automatically create on-premises AI inference. An MSP architecture using Seafile, Codex, and Claude must document four separate boundaries: content storage, endpoint tool execution, model-provider processing, and optional connector or network access.
Current as of 2026-08-15
OpenAI’s authentication documentation distinguishes local Codex work from the workspace or API data controls that apply; neither that page nor the local-environment documentation says model inference remains on-premises. Anthropic’s Cowork security architecture likewise describes a local VM while explicitly requiring Anthropic’s API.
Decision summary
- Local storage is not the same as local inference.
- Provider data handling depends on account type, authentication path, retention, residency, and sharing settings.
- Least-privilege mounts and local containment reduce tool risk but do not eliminate prompt-injection or exfiltration risk.
- Human approval, audit logs, and tested rollback remain required for consequential actions.
Map the four boundaries
- Storage: where Seafile libraries, versions, and backups reside.
- Execution: where shell commands, editors, and file tools run.
- Inference: which provider receives prompts, context, and model inputs.
- Connections: which APIs, MCP servers, web resources, and SaaS systems the agent can reach.
Document provider processing
OpenAI states that ChatGPT authentication follows workspace controls such as role-based access, retention, and residency, while API-key use follows the API organization’s settings. Anthropic says commercial data is processed under its commercial terms and is not used for training by default. Neither statement means no third party processes the data.
Constrain tools and content
- Mount only the project folders required for the task.
- Separate read-only research from write-capable execution.
- Use approved service accounts and short-lived credentials.
- Restrict outbound destinations and connectors where practical.
- Treat retrieved documents and tickets as untrusted input.
- Require human authorization before sending, deleting, deploying, or changing production.
Validate the operating architecture
Document the actual data path for each workflow: Seafile storage, endpoint execution, provider inference, and connectors. Measure DOCBOT or agent workflow performance with a defined task set, baseline, reviewer, and failure criteria. Treat an intended control as unverified until the configured system demonstrates it.
For related guidance from ITECS, see ITECS managed intelligence services.
Sources and update trigger
- OpenAI — Codex authentication and data controls
- OpenAI — Codex local environment
- Anthropic — How we contain Claude
- Anthropic — Commercial terms
Review trigger: Revalidate whenever provider terms, authentication, retention, residency, connector behavior, or the ITECS architecture changes.