When deploying AI safety tooling, you choose between self-hosting an open-source solution and using a managed service. Each approach has different implications for control, cost, compliance, and operations.
Self-hosted (open source)
Run the safety stack on your own infrastructure. Authensor is designed for this model.
Advantages:
- Full control: You own the code, the data, and the infrastructure. No vendor dependency.
- Data sovereignty: Audit logs, policies, and agent data never leave your infrastructure. Critical for regulated industries.
- Customization: Modify the policy engine, add custom Aegis detectors, extend Sentinel monitors. Fork and change anything.
- Cost at scale: No per-request pricing. Costs scale with your infrastructure, not your usage.
- No vendor lock-in: Switch providers or modify the stack without migration headaches.
Disadvantages:
- Operational burden: You run the database, manage upgrades, and handle availability.
- Setup time: Initial deployment takes more effort than signing up for a service.
- Expertise needed: You need someone who can operate the infrastructure.
Managed service
Use a vendor-provided safety service (AWS Bedrock Guardrails, cloud-hosted guardrail APIs).
Advantages:
- No infrastructure: Someone else handles availability, upgrades, and scaling.
- Fast setup: Start in minutes, not hours.
- Support: Vendor support for issues and configuration.
Disadvantages:
- Data leaves your infrastructure: Audit logs, tool calls, and potentially sensitive data are sent to the vendor.
- Per-request pricing: Costs scale linearly with usage. High-volume agents can be expensive.
- Limited customization: You work within the vendor's feature set.
- Vendor dependency: Pricing changes, feature removals, or vendor shutdown affect you directly.
- Model/platform lock-in: Many managed services only work with specific model providers.
Decision framework
| Factor | Self-hosted | Managed |
|--------|------------|---------|
| Regulated industry (finance, health) | Preferred | Risky (data sovereignty) |
| Small team, low volume | More setup work | Faster start |
| Large team, high volume | More cost-effective | Expensive at scale |
| Custom safety requirements | Full flexibility | Limited by vendor |
| Multi-cloud or model-agnostic | Works everywhere | Often locked to one platform |
The Authensor approach
Authensor is open source and designed for self-hosting, but it is built to be easy to deploy:
- Docker Compose setup for the full stack
- Zero-dependency core packages (no complex dependency trees)
- PostgreSQL for storage (widely available, well-understood)
- SDK works standalone without the control plane for simple deployments
The operational burden of self-hosting Authensor is comparable to running any Node.js service with a PostgreSQL database. If you can run a web application, you can run Authensor.