When AI Agents Belong in a Private Cloud

The control boundary question

Private cloud becomes relevant when the control boundary itself is part of the requirement.

The question is which boundary auditors, customers, and your threat model require.

What must stay isolated

A serious private deployment isolates the data plane, runtime network, secrets, logs, and encryption keys.

Customer-managed keys often decide whether the provider can read customer data after revocation.

Avoiding the forked-product problem

Customer-specific forks that cannot receive normal upgrades become long-term liabilities.

Private should mean isolated, not abandoned.