You hand your agent a repository and ask it to make the failing tests pass. It clones, installs dependencies, writes a patch, runs the suite, reads the error, writes another patch. Somewhere in the middle it writes a throwaway script to move some files, runs it, and never mentions it. You did not see that script. Nobody reviewed it, nobody approved it, and by the time you go looking, it is gone. The container you ran all of this in was built on an assumption that had quietly stopped holding — that someone, at some point, had read the code.

A partition is not a compartment

Walk a building with someone who does fire safety and you stop seeing one space. Most of the internal walls are partitions: light material, stopping at the suspended ceiling, meant to separate one desk from the next rather than to hold anything back. Where you know what a space holds, that is the right build.

That is a container. Work is kept apart from the work beside it, but the line is drawn by the one kernel everything sits on, and ends where that kernel’s attention ends.

A compartment is a different construction. It goes the full height, past the ceiling void, up to the structure, and it is specified by how long it has to hold — thirty minutes, an hour — whether or not the space behaves. That is a microVM: the sandbox gets a kernel of its own rather than a slice of yours, and what stands between it and your machine is not a setting the guest can argue with. You build that way for contents you cannot inspect, because nobody will be there when they misbehave.

A fire door with unsealed cable holes above the ceiling is not a compartment, though; smoke goes wherever the pipes went. The same gap shows up as capping the network and leaving processor, memory and disk open — nothing escapes, and the sandbox starves the host anyway. The shut-off, meanwhile, sits outside the space, where whoever is inside cannot reach it, which is what an authentication proxy does with credentials: the call to an external service goes out through the proxy that holds the token, which therefore never enters the microVM.

Every crossing is drawn before the walls go up

None of this is settled by whoever happens to be in the space. It is settled on a drawing: what has to hold and for how long, where the doors are, every service that crosses, and how each crossing is sealed. A sandbox manifest is that drawing, written before the workspace exists. It declares the repository, the files and directories, the mounts, the environment and the initial accounts, with every path relative to the workspace. Absolute paths and paths that climb out with two dots are the classic error: the document stops describing a workspace and starts describing one machine in one building.

Capabilities are on the same drawing, and that is the part worth staring at. Skills, memory, filesystem, shell, compaction — each is granted explicitly, so a run has them because the manifest said so, not because the runtime happened to offer them. A due-diligence agent gets the data room mounted read-only and one writable path for its report. None of that is implied; all of it is declared, and you can read it before anything runs.

What stays off the drawing matters as much. The agent’s instructions and defaults, the loop and approval state of a run, the credentials of the control plane — those live outside the workspace, and keeping them out is the point. The mounts are the seam where this leaks: treat a remote mount as workspace content to be copied forward and you persist data, and sometimes credentials, in a place nobody chose.

The boundary is something you can read

Because the manifest is a document, the question every reviewer eventually asks — what can this thing touch — has an answer in advance rather than one reconstructed afterwards from an incident. The other end of the run works the same way. A microVM logs its own calls beside the agent’s trace, so you get process and network evidence, not just the agent’s account of its afternoon. An agent narrating its own actions is a witness, not a record.

None of this makes the code safe. It moves the question somewhere you can watch it, which is the same instinct as putting the agent inside the sandbox rather than mediating each of its calls. The difference is that here the boundary is written down, and signed, before anything is switched on.

Code nobody read does not get the open floor. It gets a compartment, and a drawing that says what may cross it.