How does Catalyst handle security and compliance in air-gapped setups vs Temporal self-hosted?

Both support air-gapped deployments. Self-hosted Temporal gives you full control over security policies, encryption, and access. Catalyst provides workload identity for fine-grained auth and MCP tool authorization policies, which Temporal lacks natively. In air-gapped environments, Catalyst runs with Diagrid managing the control plane, while you control data and network boundaries. Temporal self-hosted requires you to implement all security measures yourself. Catalyst adds built-in policy enforcement for agent tools, reducing security engineering effort.