As developers increasingly delegate work to AI agents, these agents require broader access to systems and resources. They read files, run shell commands, execute generated code, and call APIs. That is what makes agents useful, but that same autonomy is the source of the biggest risks. Coding assistants, home-grown harnesses, and off-the-shelf agents increasingly run in “YOLO mode,” approving every action without human review. Agents can wander out of their working directory, run a dangerous command, or reach a credential they were not meant to see.
The usual solution to this problem is a sandbox, which puts a boundary around what an agent can access. But access is only part of what we want to control. An agent investigating a production incident might need to read logs or inspect infrastructure, without being allowed to change it. Containers and microVMs provide strong isolation, but isolation alone doesn’t enforce contextual rules. Once an agent can reach a…
