Something clarifying happened this month: the argument ended.
For two years, "governance" was the word cautious people used and vendors avoided — it sounded like friction, and friction doesn't demo well. Then, in the span of one August week, a major industry conference ran an entire track on governance, logging, and auditability in agent environments, and Cloudflare — one of the largest infrastructure companies on earth — launched an AI workspace marketed explicitly on governance, ownership, and freedom from vendor lock-in.
When incumbents adopt your vocabulary, the debate is over. Nobody serious still argues that AI agents should run ungoverned. We built GNexusOS on that premise when it was contrarian; watching it become consensus is gratifying.
But consensus has a way of blurring the question that matters. Now that everyone sells governance, the discriminating question is no longer whether your agent platform has it. It is where governance lives — and who has custody of everything it touches.
Governance has two halves
The visible half of governance is process: approvals, logs, audit trails, spend controls, permissions. This is the half you can screenshot, and it is the half every platform now advertises.
The invisible half is custody: where the artifacts of governance — and everything they protect — physically exist. The credentials. The logs themselves. The record of what your agents did and the data they did it with. Process determines whether your agents behave. Custody determines who else, in the worst week of some vendor's year, can touch what your agents touched.
A network-hosted platform can genuinely deliver the first half. Cloudflare's new workspace, by every indication, does: access control, model spend visibility, sensible defaults. What no network-hosted platform can deliver — structurally, not for lack of trying — is the second half. When governance runs on someone else's computers, its artifacts live on someone else's computers. Custody has been assigned by the architecture before any policy is written.
What custody failure looks like
This is not hypothetical. The same week the industry converged on governance, security researchers disclosed that thousands of API tokens for a popular network-reachable automation platform had leaked through public code repositories — and that when they tested a sample of live instances, more than a third accepted the leaked tokens, exposing workflow definitions, execution histories, and stored credentials.
The point is not to fault one project; its maintainers ship serious software and responded as good engineers do. The point is what the incident reveals about a whole architecture class. Every automation platform that is reachable over a network, holding credentials for many users, presents one address where a leaked token means someone else's hands on your workflows, your history, your keys. The blast radius is a property of the topology. No governance dashboard changes the topology.
This is what we mean when we say governance you rent is custody you gave away. The policies were fine. The custody was the vulnerability.
The structural answer
Local-first is not a preference about where software feels nicer to run. It is a custody decision.
On a local-first platform, the governance artifacts live where the work lives: on your machine. Conversations, task records, approvals, rejections, the evidence log your agents' autonomy is built on — files on your disk, in your formats, inspectable forever. Credentials are sealed in your operating system's keychain, guarded by hardware, never pooled in anyone's multi-tenant vault. There is no shared address where your token and ten thousand others wait behind the same door, because there is no shared address at all.
This architecture also enables the part of governance that network platforms quietly skip: verification. An agent's claim of "done" can only be checked against ground truth by something that can see the ground truth — the actual files, the actual records, the actual results on the actual machine. A platform that sits where your work happens can audit reality. A platform that sits in a datacenter can audit only what passed through it. We have written before that autonomy should be a promotion earned on a record, and that a rung is only real where it is enforced; custody of that record is what makes the record trustworthy.
None of this makes local-first software immune to every failure — nothing is. It changes whose failure can reach you. Your machine can be compromised; that risk you already own, manage, and can insure. A vendor's breach, a subpoena to a third party, a quiet terms-of-service change over data you cannot see — those risks arrive with multi-tenant custody and leave with it.
The questions that now separate platforms
Since every vendor will say "governed" from here on, ask the custody questions instead:
Where do the logs physically live, and can I point to the files. Where do my credentials sit, and how many other customers' credentials sit beside them. If this vendor has its worst security week, what of mine is inside the blast radius. Can the platform verify my agents' claims against my actual system, or only against its own records of itself. And if the vendor disappears tomorrow, do I still have the record.
A network-hosted platform answers these with policies. A local-first platform answers them with architecture. Policies are promises; architecture is fact.
We are glad the giants now say governance. It means the market learned the right word. GNexusOS exists for the operators who ask the second question — and want the answer to be: on my machine, under my command, in my custody.