Pilot a self-hosted AI coding agent: IBM Bob checklist

Before a self-hosted AI coding agent touches a regulated repo, run one file through it and watch where the model call goes. Treat the agent as a harness plus a model endpoint, and verify code residency, model approval, and license terms before the pilot becomes a commitment. IBM declared Bob's self-hosted mode generally available, which makes it a useful example.

IBM announced on October 1, 2026, that enterprises could run Bob in self-hosted mode. The self-hosted option can run in customer-controlled deployments, such as local infrastructure, private or sovereign clouds, and isolated air-gapped networks. In a June 2026 IBM Institute for Business Value survey, 68% of executives said data residency and sovereignty requirements across geographies are difficult to meet. Futurum Research forecasts that hybrid and edge deployments will hold 44% of the AI infrastructure market in 2030, while public cloud share falls to 46% over the same period.

The pilot is a residency test, not a demo

Start with the boring question: does the code stay where it was typed? A vendor demo can look clean while the model call still goes outside the approved boundary. The pilot should answer that question with a packet capture, a network policy, and a named owner for each hop. If the agent can edit a file, it can also leak it. The first hour should be spent mapping the path from editor to model, not polishing a prompt.

Residency is the control. If the codebase is regulated, the model endpoint must sit inside the same trust boundary as the repository, the build system, and the secret store. A private-cloud deployment helps only if the network path is actually private. An air-gapped environment removes the obvious external path, but it also makes the pilot more brittle. You need to know what the agent does when the model is missing, slow, or blocked.

The checklist is the contract

Keep the list short enough to run in a single afternoon. Each item should produce a yes, no, or a ticket. The deployment should be controllable before anyone calls the pilot a success.

• Code residency: run one file through the agent and confirm the model call stays inside the approved network boundary.
• Model endpoint: identify the model host, version, and egress path, then confirm none of them point outside the pilot zone.
• Model approval: check that the model is on the approved list and that the version is pinned before anyone runs a task.
• BYOL terms: match the license file to the model and deployment, and confirm eligibility under the bring-your-own-license path.
• Air-gap: disable or firewall external calls, then confirm the agent cannot reach the public internet from the pilot node.
• Operator deployment: run a single-node proof of concept with the deployment manifest, and confirm health checks, logs, and restart behavior.
• Security approval: get sign-off on data flow, identity, audit logs, and who can approve a model change.
• Failure checks: stop the model endpoint and confirm the agent fails closed instead of sending code to a fallback.

The checklist is the part of the pilot that survives a postmortem. It turns vague comfort into evidence: an egress path, a pinned model version, a license that covers the deployment, a disabled fallback, a repeatable install, a named owner, and an agent that stops instead of rerouting. The pilot is not complete until the team can show the path, the version, and the license in one review.

Model approval is a supply-chain question

A self-hosted agent is only as safe as the model it calls. IBM's current customer-managed model support includes Nvidia's Nemotron and Poolside's Laguna. That list is short enough to review, but it still needs a version pin, a checksum, and a named approver. If the model changes, the residency answer can change too.

Bob's self-hosted option includes a bring-your-own-license path for eligible existing licenses on IBM's supported model list. That sounds administrative, but it is a pilot blocker. If the license does not cover the deployment, the model endpoint is not approved, even if the network design is tidy. The license check is the final control before the model endpoint can be treated as approved.