Local-First AI Coding Workflow for Security-Conscious Teams

If your transcripts cannot leave the machine, your supervision has to stay on the machine too. This is a working routine for watching coding agents without centralising anything — written so you can hand the boundary statement to a reviewer without hedging.

Before you start

Agent Island installed on the workstation that runs the agents
A stated position on what may leave the machine
Someone who will actually review the diffs

1. Write the boundary down before you add tooling

Decide two things first: what data may leave the machine, and who is allowed to execute. Agent Island's side of that is narrow enough to state in one sentence — it reads local session records, has no account and no product telemetry, and never uploads transcript content. Usage refreshes reuse the credentials your coding tools already hold to read the same figures the providers' own dashboards show.

You should see: a boundary you can state in one sentence without qualifying it

2. Audit the rest of the chain, not just the monitor

There is nothing to disable on Agent Island's side. The parts that usually ship data are elsewhere: shell integrations, hooks, third-party wrappers, and IDE extensions. Enumerate what is installed and where each one sends data before you certify the workstation.

You should see: a list of every component in the chain with its outbound behaviour recorded

3. Confirm what the monitor actually reads

Reads are limited to the session records the coding tools already write, plus file modification times, session identifiers, project paths, session titles, token counters, and the structural markers that mean a turn ended. Files are read in place and never copied elsewhere. If a reviewer wants specifics, the privacy page lists them by provider.

4. Run one bounded unit of work

Give the agent a task with a defined end rather than an open-ended session. Bounded work is what makes the your-turn signal meaningful: when the turn ends, there is something specific to review instead of an ongoing stream to supervise.

You should see: a session that reaches your turn rather than running indefinitely

5. Review the diff, never the closing sentence

A confident summary is not evidence of correctness. Treat the alert as "this is ready for you" and then review the change itself. The app never resumes or re-prompts a session — visibility and execution authority stay separate by design, which is the property that makes the tool safe to run on a supervised workstation.

6. Decide retention deliberately

The session records on disk are your audit trail and your exposure at the same time. Pick a retention period on purpose: the same files that make monitoring work are the ones an investigation would ask for, and the ones a leak would expose.

You should see: a documented retention decision rather than an accidental one

If it does not work

Review asks where transcripts go

Nowhere. There is no Agent Island backend to receive them — point them at the privacy page and the public source.

Policy forbids provider network calls

Usage rows need those endpoints; local session monitoring does not. Turn the usage side off and the state monitoring still works.

An agent ran longer than policy allows

A task-scoping problem, not a monitoring one. The monitor reports state — it does not enforce limits.

Reviewer wants proof rather than claims

The app is MIT-licensed and public. Reading the source is the strongest available answer, and it is the one to offer first.

Shared screen exposes session names

Turn off Show thread details in Settings → Status guide — alerts then say only that a background session finished a turn.

For exactly what is read and what never leaves, read the local data boundary.

← All posts