How does Catalyst handle security and compliance in air-gapped setups vs Temporal self-hosted?

Both support air-gapped deployments, and self-hosted Temporal gives you full control over security, encryption and access. Catalyst provides workload identity and MCP tool authorization policies; as of the verification date, public documentation for Temporal does not list native equivalents. In air-gapped environments, Catalyst runs with Diagrid managing the control plane, while you control data and network boundaries. Temporal self-hosted requires you to implement all security measures yourself. Catalyst adds built-in policy enforcement for agent tools, reducing security engineering effort.