Hybrid Agentic Work

This chapter applies the hybrid patterns of Chapter 14 where they are hardest to hold: agentic work tools on the desks of engineers, analysts, and operators. A coding or task agent, Mode 3 in Chapter 2's terms, reads files, runs commands, and sends everything it gathers to a model. It works best with a cloud frontier model, yet much valuable work must not leave the organisation's control. The chapter shows how a provider-neutral agent, with OpenCode as the worked example, lets one workflow use a self-hosted model for sensitive information and a cloud model for the rest, and what must surround it for that routing to be a control rather than a hope. Chapters 11 and 19 supply bounded autonomy and containment; this chapter adds which model may see which information.

The hybrid pattern keeps everything except the model constant: the agent definitions, skills, and MCP servers of Chapter 8 are the same in every workspace, while public and internal work uses a cloud frontier model and confidential and protected work a self-hosted open-weight model.

The decisive fact is what the model sees. An agent sends whatever context it gathers to the selected model: file contents, command output, test logs, MCP tool results, and its own earlier turns. Sensitive information disclosure through that context is the second risk in the OWASP list (27, OWASP, 2025). Once a session against a cloud model has read a protected file, the disclosure has happened; switching model halfway does not recall it, and a compacted history carries it forward. Routing must therefore be decided before the session starts, by the classification of the workspace, never per prompt.

Primary topics explored

1. One workflow, two model tiers
2. OpenCode and sensitive information
3. Routing by information class and jurisdiction
4. Enforcement sits outside the client
5. Capability gaps and evaluation
6. Operating self-hosted models for agentic work