security//agent containment

Agent containment is the layer of enforcement outside the model that limits what an agent's actions can actually do, so that the model may generate a dangerous action without it taking effect. It rests on a separation: a shell command can be proposed in text without possessing authority to execute, and containment preserves that separation.

Agent containment is the layer of enforcement outside the model that limits what an agent's actions can actually do, so that the model may generate a dangerous action without it taking effect. It rests on a separation: a shell command can be proposed in text without possessing authority to execute, and containment preserves that separation.

Containment includes filesystem sandboxes, read-only mounts, network restrictions, scoped credentials, rate limits, approval gates, execution isolation, and recoverable operations. Its first rule is minimum privilege: each agent run gets only the credentials and writable scope its present task requires.

The model policy determines what the agent attempts. Enforcement is a separate layer that determines what the environment actually permits. Keeping those responsibilities separate is the core security boundary.

Prompt instructions are useful policy guidance, not a hard security boundary. A restriction is strong only when the component being constrained cannot rewrite, bypass, or socially negotiate it away.

The objective is not perfect model obedience. It is a bounded failure surface when the model, user input, tool output, or surrounding software is wrong.