Private data, local models, tools and MCP: what stops an agent doing more than the task?

[javmann100]

Genuine question, not a hypothetical. PrivateGPT exists because the data must not leave, and the new API layer adds tools, MCP and text-to-SQL on top of local models. That is the moment the risk moves from data leaving to an agent acting: a query that returns far more than it should, a tool call that writes. When that happens, what stops it today: a prompt, a limit in code, or noticing afterwards?

I am building mnki, an open-source trust layer with a fourth answer: bounded authority checked outside the model before an action runs (this agent, for this principal, these tools, these limits), a human approval on a phone for the cases that deserve one, and a signed record of every decision. It runs self-hosted next to a deployment like yours and sits in front of a tool executor or an MCP server, so it fits alongside PrivateGPT rather than inside it. You mention an API gateway for governance on your roadmap; I would like to understand what your regulated users ask for there.

Twenty minutes would help me more than any demo; a reply here is plenty. Reference implementation, Apache-2.0: https://github.com/MNKIAgentOS/agent-trust; integration paths: https://mnki.com/docs/integrations. Thank you for PrivateGPT; it is still the reference for private-by-default deployments.