Self-Hosted Agent Governance

Self-hosted agent governance means the layer that decides what AI agents may do, where humans must approve, and what gets recorded runs on infrastructure you control. The agents act on your code; the control plane, the credentials, and the audit record never leave your network.

Why self-host it

The audit record is the reason. An agent that changes code produces evidence a review needs: what it was asked to do, what it produced, which checks ran, and who approved it. Hosting that record on someone else's servers turns a query you own into a data-processing question you have to answer for every auditor and every jurisdiction.

A self-hosted control plane also keeps the credentials with you. Connector tokens are encrypted at rest in your database and decrypted once at run start into a run-scoped context, and Modulo leaves telemetry off by default.

Who needs this

Teams in regulated industries where the code and the process cannot leave the estate. Teams that run on a network with no route to the public internet, where a SaaS control plane has no network path to the repositories it would govern. And teams that want a governance layer that survives a vendor's pricing change or shutdown, because the instance is theirs.

How Modulo is deployed

Modulo runs as a self-hosted service on Docker Compose or on Fly.io, on your Postgres. Both the free Community edition and the paid Team tier run entirely under your control; there is no hosted tier to migrate away from. See Installation and Configuration.

Deployment keeps the source in reach too. Modulo is source-available under the Business Source License: the farnalabs/modulo repository is public and inspectable. The license restricts the field of use and does not restrict internal use.

What the control plane contains

Pipelines that compose agents into typed, gated steps. Human-in-the-loop (HITL) gates where a reviewer approves or rejects with full context. Bounded autonomy: you set each pipeline's autonomy level, with eval scores as the evidence for raising it, while token budgets, a spend circuit breaker, and an org-wide pause cap what it can do. A hash-chained, append-only audit log with a versioned snapshot per run. Spend limits and a per-run cost record. See What is Modulo for the component map.

Where to read next

For the category itself, its adjacent tools, and how governance requirements differ across them, see the self-hosted agent governance guide.

Where to go next

• Self-hosted agent governance: the category guide
• Audit Trail for AI-Generated Code: the record in detail