Verified 2026-07-28. The useful question is not whether an AI coding tool runs locally. The question is which data leaves the machine, which actions the agent may perform, and what evidence a reviewer receives before accepting the result.
Start with the data and authority boundary
Write down four boundaries before opening a session: the files the agent may read, the files it may change, the commands it may run, and the external systems it may write to. A broad repository checkout plus unrestricted credentials is not a local-first control; it is merely local execution with wide authority.
Keep secrets out of prompts and transcripts. Use scoped environment variables or existing credential stores only when the task genuinely requires them, and separate read access from write access. A monitoring surface should not expand either boundary.
Observe state without centralizing transcripts
Teams often add a dashboard because several sessions are hard to follow. The shortcut is to upload every transcript to a central service. That makes status convenient but creates another copy of source context, tool output, paths, and possibly sensitive text.
A local companion can reconstruct working, waiting, finished, and needs-you states from records already written on the machine. The monitor should retain provider and session identity, expose freshness, and avoid treating silence as proof of completion. It should not need the transcript body on a remote server merely to show that a turn changed state.
Run one bounded unit of work
- Define the expected diff and the directories that may change.
- State the validation command and the evidence needed at the end.
- Give the agent only the credentials and network access required for that unit.
- Watch session state locally instead of polling the terminal.
- Stop when the requested artifact and its verification receipt exist.
Smaller units make the review boundary visible. They also make a failed run cheaper to discard because the agent has not accumulated unrelated changes.
Review the result, not the completion phrase
An assistant message that says "done" is not acceptance evidence. Review the actual diff, confirm that unrelated files stayed untouched, run the named tests, and inspect the user-facing surface when behavior changed. For an external action, require a success page, message identifier, public URL, or explicit error state.
Keep those receipts separate from status signals. A your-turn alert says that attention is needed; it does not say the change is correct, secure, or approved.
Preserve enough evidence for an incident
A local-first policy should not erase accountability. Retain the minimal facts needed to reproduce a decision: task scope, changed files, commands run, test results, reviewer decision, and the version that shipped. Avoid keeping entire raw transcripts when a bounded receipt answers the audit question.
Where Agent Island fits
Agent Island v1.7.1 is a free, open-source status companion for Claude Code and Codex on macOS and Windows. It reads local session records to show status and your-turn alerts, uses no Agent Island account, and does not upload session data to Agent Island. It does not sandbox the coding agent, approve changes, or replace repository security controls.
Continue with the local data boundary, the session-state evidence model, or the tool comparison guide.
← All posts