# OpenBot Gives Each AI Coworker Its Own Governed Computer

> Self-hosted platform where each agent gets its own container, browser, and workspace, and every action passes a policy gateway before it happens.

Published: 2026-08-25
URL: https://daniliants.com/insights/openbot-gives-each-ai-coworker-a-governed-computer/
Tags: ai-agents, self-hosting, browser-automation, sandboxing

---

## Summary

OpenBot (CopilotKit) is a self-hosted, open-source platform for running "AI coworkers". Each agent gets its own container, browser profile, and file workspace, and every action it takes (browser click, file write, MCP tool call) is decided by a policy gateway *before* it happens and logged *after*. It's framework-agnostic: any agent built on the open AG-UI protocol (LangGraph, CrewAI, Pydantic AI, Google ADK, or hand-written) can plug in as a "Bot."

## Key Insight

- **The governance model is the actual product, not the agents.** Every browser, file, and MCP action routes through one gateway that resolves the target, evaluates a CEL policy, writes an audit row, *then* calls the computer. There's no code path that acts before the record exists. Deny is evaluated before allow, and a missing or malformed policy fails closed (refuses, doesn't default-permit).
- **"A computer per Bot".** Each agent gets its own Docker container, `/workspace` volume, and browser profile (optionally sandboxed under gVisor via `COMPUTER_RUNTIME=runsc`). This is the practical difference between "an agent that can use your tools" and "an agent you can actually let near them", with no shared session bleed between agents.
- **Human-in-the-loop handoff is a first-class primitive, not a bolt-on.** When a Bot hits a login wall or 2FA, it requests control (`computer.help_requested`), a human takes the wheel (`computer.control_taken`), and while a person is driving, Bot actions are refused rather than queued, avoiding race conditions between human and agent input.
- **Secrets never enter the transcript.** The audit trail records that a credential was requested and how long it was, never the value or content. Credentials are stored write-only through `/admin/credentials`, encrypted at rest, never returned by any API.
- **MCP governance is per-vendor and per-tool.** The catalogue only carries MCP vendors the deployment explicitly vetted (Google Drive ships by default), any tool not positively classified as read-only is treated as a write, and a Bot that lacks a connector says so rather than being able to browse to the vendor's site to find out.
- **SSRF-style protections are built into agent registration.** Registering a custom AG-UI endpoint validates the target with the same checks used for browser navigation, both at registration and on every redirect, and private or internal addresses are refused unless explicitly allowlisted in `AGENT_ENDPOINT_ALLOWED_HOSTS` (exact host:port match, no wildcards).
- **No model lock-in.** The box ships with zero model included. You bring your own OpenAI, Anthropic, or Google key, and `OPENAI_BASE_URL` / `ANTHROPIC_BASE_URL` support routing through your own gateway or proxy.
- Runs entirely on a laptop via `bash scripts/start.sh` (Docker Compose plus Bun), a single container image is available for simple deploys, and `OPENBOT_SINGLE_USER=true` is explicitly an insecure default meant only for local trial. Production requires Google, Microsoft, Okta, SAML, or OIDC sign-in or the server refuses to start.