directly on the host,

osqueryi

is the only way to write a query against osquery and get a result. and osqueryi runs as the user who launched it. it also has no access to the rocksdb database that the daemon uses, it just queries apis directly in real time