What runs where, and who may start it
The question is no longer “ChatGPT, yes or no”. The question is what runs where and who may start it. Local and in-house AI is growing alongside the cloud: a Mac mini handles inference, open weights keep closing the gap, and agents are the product of the year and the risk of the year. This series takes you from your first local model to a control room you run the whole thing from — and to the rules without which it all falls apart.
45 parts · six tracks · more coming
Read it front to back like a course, or jump around by tag. If in doubt, start with the first part of each track — they assume you have installed nothing yet.
Prefer a fixed order to a signpost? Follow the path An agent on your NAS from scratch (13 steps).
01 · 5×
Model, harness, agent — and why the question moved from “AI yes or no” to “what runs where”.
02 · 5×
Two complete setups from hardware to invoice: what runs where, what it costs and why it is put together this way.
03 · 5×
Your first model on your own machine: Mac mini, Windows with an Nvidia card, memory, and when local is enough.
04 · 6×
One gateway in front of every model, API keys in one place, and routing each job to what handles it best.
05 · 8×
A control room in your pocket: Telegram as the panel, a safe route home, and a queue you approve yourself.
06 · 8×
Files from your disk into the chat: how it really works, what RAG is, what MCP does, what stays off the cloud.
07 · 8×
Agents are the product of the year and the risk of the year. One page of rules and the case studies behind them.
Tags
16 parts tagged “Security” · Clear filter
In August 2026 alone, Grok Bot, Cursor Origin, Slack Code and Claudeforce all came out. They all solve the same thing: letting AI out of the chat and into your work. And they all run into the same question that nobody can answer elegantly — who vouches for it.
Two containers on a home NAS: one holds all your chats, the other is an agent that reads them continuously, writes promises into Notion and answers you in Telegram. Claude prepares the containers; you just log in twice in the terminal.
A key is a password nobody changes, because nobody remembers it exists. Where to store it on a Mac, on Windows and on a server, why it does not belong in a chat or in a file in the project, and how to tell that it has got away from you.
Forwarding a port on your router is the fastest way to hand your model to the entire internet. A private network makes it available only to your devices and takes ten minutes to set up — no public IP, no certificates, no holes in the firewall.
Your NAS now runs an agent that reads your messages. That turns a box for photos into a machine worth locking properly. A concrete procedure for DSM: Tailscale, what to switch off, the two scheduled tasks people forget, and a test you can trust.
“AI sees my files” means five different things with very different consequences for privacy. The difference between attaching, an index, a connector and direct access — and why you should know it before you upload a contract anywhere.
Connectors aren't only for cloud services. A local MCP server can give the model access to a folder, a database or the command line — and the difference between a useful hook-up and a dangerous one is a single parameter: how much you fence off for it.
A short list of things that shouldn't leave your machine, and three technical measures that mean it doesn't depend on your memory. Because a rule you have to remember will fail sooner or later.
After three months the agent has your memory, fine-tuned procedures and the keys to everything in a single folder. Which of that to back up, where, how often — and why the backup has to sit somewhere the agent itself can't reach.
A model follows the rules most of the time. A check written as ordinary code follows them every time. What belongs in it, what does not, how to offer it to an agent as a tool and why it should stand at the end of every text that goes out.
It isn't a bug in the code that someone will fix. It's a property of the way models work — and the only defence is to take one of three capabilities away from the agent. Which three they are, and how to check your own setup.
A twenty-page policy nobody reads protects less than a single page that everyone has on the noticeboard. A complete template with eight points that takes five minutes to read and can be adopted this week.
In March 2026 a modified version with a credential harvester made its way into the package of a popular AI gateway for forty minutes. Forty minutes was enough. What happened, why it's a warning for anyone building their own control room, and what to do about it.
An agent you have to explain everything to again is just a more expensive chat. A skill is a written-down procedure that it loads by itself next time. How one comes about, what it looks like inside, how to fix it — and why an agent's learning should pass your review just like everything else.
Your agent knows your promises, your mail and your calendar. You can't lend it to the children. A second profile has its own memory, its own bot and its own personality — and this part also says where a profile stops being enough and you need a second container.
An agent for one person is a tool. An agent for five people is a colleague, and it has to be clear who it answers to, who may do what and who pays for it. A three-role model, a shared channel instead of private messages, and five decisions to make before you switch it on.
Get the next part
New parts and what matters in the world of agents go out in the weekly newsletter.
The Top 30 tips e-book, free — it lands in your inbox right away.
Then 1 tip a week · no spam · unsubscribe in one click