Bring Your Own Agent Is Becoming Table Stakes
"Bring your own agent" — letting customers upload prompts, tool definitions, and behavioral configuration into a vendor's cloud — has gone from differentiator to checkbox.
Higher-ed AI vendors offer it. Enterprise work assistants offer it. The pattern is the same everywhere: you write the agent, they run it on their compute, against their choice of model, behind their network.
That works for organizations with no data-residency, no model-procurement, and no audit constraints. For the segments ibl.ai serves — financial services, healthcare, government, and regulated education — the line stops at "your compute, your model, your network."
Bring Your Own Claw Goes One Layer Deeper
A claw is the agent runtime — the process that executes prompts, calls tools, manages memory, and routes requests to a model provider.
Bring-your-own-agent means you bring configuration into someone else's runtime. Bring-your-own-claw means you bring the runtime itself.
You install OpenClaw or NVIDIA NemoClaw on your own server, your own VPC, or your own air-gapped environment.
ibl.ai handles the user-facing chat, mentor configuration, agent identity, skill orchestration, and model-provider routing — over a secure WebSocket with Ed25519 device-identity signing.
The full setup guide is open source: github.com/iblai/iblai-claw-setup.
OpenClaw vs NemoClaw — Pick the Runtime That Matches Your Stack
ibl.ai supports two runtimes that share the same protocol with the platform.
OpenClaw is the open-source agent runtime. MIT-licensed, runs on a 2-vCPU/4GB VPS or larger, supports Anthropic, OpenRouter, and any OpenAI-compatible provider with automatic fallbacks.
Most teams start here. The license is permissive, the dependencies are minimal, and a development instance costs about $4/month on a Hetzner box.
NVIDIA NemoClaw is the enterprise-grade runtime. GPU-accelerated, tightly integrated with NVIDIA's NeMo Guardrails framework for programmable safety, jailbreak prevention, and PII redaction.
It's the choice for organizations standardizing on NVIDIA's enterprise AI stack, or for any deployment where guardrails need to be auditable as code (via Colang) rather than locked inside a vendor's policy engine.
Either runtime connects to the same ibl.ai endpoints, so the application layer — mentors, skills, multi-agent orchestration, analytics — is identical regardless of which claw you run.
What ibl.ai Handles So You Don't Have to Rebuild a Platform
Self-hosting the runtime is the privacy and sovereignty win. The other half — building the user-facing platform around it — is the part most teams underestimate.
ibl.ai handles that half centrally:
- Agent identity and personality configuration — version-controlled, API-managed.
- Skill system — reusable scripts and resources, assigned to agents, pushed to claw instances.
- Multi-agent orchestration — multiple agents on a single gateway (tutor, advisor, intake, etc.).
- Model routing with fallbacks — switch providers without touching the runtime.
- Health, connectivity, version, and security audits — through the platform API.
- Application surfaces — chat UI, instructor and admin dashboards, learner analytics, and admin consoles.
You run the compute. ibl.ai runs the orchestration and the apps. The user sees one product; your security team sees an audit boundary at your firewall.
Architecture
User (browser / app)
│
▼
ibl.ai Platform (Django Channels / ASGI)
│
▼
Claw Integration Layer (WebSocket + device identity signing)
│
▼
Caddy (on your server, TLS via Let's Encrypt)
│ reverse proxy to localhost:18789
▼
OpenClaw or NemoClaw Gateway (systemd service, loopback only)
│
▼
LLM Provider (Anthropic, OpenRouter, NVIDIA NIM, your own deployment, etc.)Two trust boundaries: between the user's browser and ibl.ai, and between ibl.ai and your claw. Model API keys, prompt data, and tool-call payloads live in your environment.
The platform sees orchestration metadata — which mentor, which skill, which model class — not raw model traffic. That's the security review.
What This Means for Each Segment
Financial Services
Customer interaction logs are CCPA / GLBA / FINRA scope. Sending them to a managed AI vendor's cloud creates a vendor data-processing relationship that compliance teams have to underwrite — every quarter, every contract renewal.
With bring-your-own-claw, the runtime sits in your existing VPC. Agent traffic touches your model provider, your KMS, your SIEM — all already inside your audit perimeter.
Agents that fit here: KYC document review, sanctions-screening narration, AML alert triage, advisor copilot, internal policy Q&A. Each one runs on a claw in your environment; ibl.ai handles the user-facing chat and the mentor lifecycle.
Air-gapped option available for trading desks and private-client teams where even Managed VPC is too exposed.
Healthcare
PHI cannot leave the HIPAA-covered boundary. Managed AI clouds force a BAA conversation, a vendor risk review, and a re-architecture every time the vendor updates their data-processing terms.
Bring-your-own-claw makes that boundary local. The claw runs in your covered environment. Patient data, clinical notes, and prior-auth narratives never traverse a third-party cloud.
Use cases: clinical decision support, prior-authorization drafting, patient-intake triage, scribing, discharge-summary review. All on a claw connected to ibl.ai for management, with the model and the PHI inside your environment.
Epic, Cerner, and athenahealth integrations run through your existing connectors — the claw calls them; the platform doesn't.
Government
FedRAMP, StateRAMP, CJIS, and IL4/IL5 environments rule out most managed AI vendors by default. The remaining options are usually the frontier labs' government-cloud variants — and those still impose a fixed model and a vendor data-processing relationship.
Self-hosted claws — including in air-gapped environments — let agencies run AI on infrastructure they already own, with model providers they already procure. ibl.ai connects to the claw the same way it does anywhere else.
Use cases: FOIA drafting, case-management copilot, citizen-service triage, internal policy Q&A, document review. The model can be a domestic open-weight deployment, a GovCloud-hosted commercial API, or anything in between.
Higher Education
FERPA-protected student data — transcripts, financial-aid records, advising notes — should not be uploaded to a managed AI vendor as a routine matter. Most institutions are now writing this into procurement policy.
Higher-ed claws run on the institution's infrastructure (often the same VPC as the LMS and SIS) and integrate with Canvas, Banner, Workday Student, Slate, and similar via API connectors and LTI 1.3.
Agents — academic advising, FAFSA support, tutoring, registrar Q&A — execute against the institution's preferred LLM provider, behind the institution's network. Faculty define the agents; IT controls the runtime.
The pre-built configurations at github.com/iblai/claws cover the most common higher-ed agents; the claw setup at github.com/iblai/iblai-claw-setup covers connecting the runtime to ibl.ai.
Why a Family-Owned, New York-Headquartered Partner Matters Here
The sovereignty story breaks if the vendor on the other side of the contract is foreign-owned, VC-controlled, or likely to be acquired before your data-residency clause is enforceable.
ibl.ai is family-owned and operated from New York, NY — a long-term partner, not a vendor selling licenses and moving on. For U.S. government, defense, and regulated buyers, that's a structural advantage over foreign-owned or VC-controlled alternatives.
The runtime is open source. The platform license is perpetual. The company is not on a five-year exit clock.
How to Start
The full setup guide — server provisioning, Caddy TLS, systemd service configuration, and ibl.ai platform integration — is open source:
- github.com/iblai/iblai-claw-setup — Connect OpenClaw or NemoClaw to ibl.ai
- github.com/iblai/claws — Pre-built agent configurations organized by vertical (enterprise, financial-services, government, higher-education, k-12, legal, medical-healthcare)
A 2-vCPU/4GB VPS (~$4/month) is enough to host a development claw. Production deployments typically run inside your existing VPC, on-premise, or air-gapped.
For air-gapped environments or a fully self-hosted ibl.ai platform license, reach out at ibl.ai/contact.