Local-first agent governance: keeping an AI agent contained