Deployment options
AgentShield always runs on the machine where the agent runs. What differs is where the record goes.
| Option | Best for | What runs where |
|---|---|---|
| AgentShield standalone | An individual, or a team that only needs local protection | The gate runs locally with the embedded community rules and your own YAML. The audit log is a local file at ~/.agentshield/audit.jsonl. No account, no network. |
| AI Agent Lens Cloud (recommended) | Teams and organisations that need one policy, one audit trail and compliance evidence | The gate still runs locally. Decisions stream to your organisation at app.aiagentlens.com. Policy, premium rule packs and enforcement mode are pushed down to every agent. |
| Shield server | Production agents, CI runners and MCP servers you do not control machine-by-machine | A long-running AgentShield process fronts the agent or MCP server and applies the same policy over the network. See Shield server and Agents in CI. |
What never leaves the machine
Evaluation is local in every option. AgentShield makes no model calls and no network calls to decide. When connected to the cloud, the audit event carries the decision, the rule, the reason and the command; commands are redacted in the dashboard by default. See Security.
Precedence of settings
Local configuration always wins over anything pushed from the cloud, so an engineer can never be put into a mode they did not set on their own machine without seeing it in agentshield.yaml:
CLI flag → ~/.agentshield/agentshield.yaml → policy.yaml → organisation policy → built-in defaults