The framing here matches what the build side looks like: the appeal of OpenClaw-style agents is that nobody grants or revokes your access, and the risk is that the same property means nobody audits it either. Two practical guardrails worth stating plainly for readers setting this up: run the agent with the least privileged credentials you can (its own OS user, scoped API keys, rate limits on anything that spends money), and treat everything it reads as potential prompt injection, because a mail-reading agent with shell access is exactly the shape of system that gets exploited.
Continuity is the underrated one: a hosted assistant can change rules or disappear overnight, and people's workflows die with it. That is the real argument for local-first, more than privacy alone. I build ScallopBot, a self-hosted assistant with long-term memory (disclosure), and the boring part of making it trustworthy was not the model, it was the permissioning and the audit trail around what the agent is allowed to touch.
The framing here matches what the build side looks like: the appeal of OpenClaw-style agents is that nobody grants or revokes your access, and the risk is that the same property means nobody audits it either. Two practical guardrails worth stating plainly for readers setting this up: run the agent with the least privileged credentials you can (its own OS user, scoped API keys, rate limits on anything that spends money), and treat everything it reads as potential prompt injection, because a mail-reading agent with shell access is exactly the shape of system that gets exploited.
Continuity is the underrated one: a hosted assistant can change rules or disappear overnight, and people's workflows die with it. That is the real argument for local-first, more than privacy alone. I build ScallopBot, a self-hosted assistant with long-term memory (disclosure), and the boring part of making it trustworthy was not the model, it was the permissioning and the audit trail around what the agent is allowed to touch.
https://scallopbot.com