Governed agent runtime
Hosts AI-agent workloads inside isolated execution layers instead of unmonitored chatbot sessions, so code execution and tool interactions are policy-mediated and reviewable.
Agent VM case study · governed sandboxing · public evidence
A governed sandbox for untrusted AI-agent workloads.
BoundaryKit Agent VM is a public security case study for running probabilistic workloads behind explicit policy boundaries, rootless runtime isolation, promotion controls, and evidence-backed validation. It is designed to show what can be measured on NUC-class hardware without exposing a live deployment map or claiming a turnkey managed platform.
Public architecture line:
NVIDIA OpenShell
Hermes Agent
rootless Podman
NUC-class hardware
NemoClaw blueprint
Operator intent
Policy gate
OpenShell + Hermes
Evidence overlay
workload governance
untrusted agent assumption
Agents are treated as probabilistic actors that can be compromised or misdirected by external input.
risk mitigation
default-deny boundaries
Constrains unverified network egress, credential access, and host reachability through explicit policy and evidence-backed denial paths.
agnostic substrate
framework independent
Standardized hosting layers that isolate autonomous workloads regardless of their underlying framework.
what it is
Enterprise governance for autonomous workloads.
Instead of exposing internal systems to unverified third-party libraries and unchecked agent scripts, this reference architecture routes agent workloads through isolated, auditable runtime boundaries. The purpose is to limit blast radius and make authority, execution state, and recovery evidence reviewable.
The architecture is agent-agnostic. Any autonomous process is assigned a risk tier and deployment archetype, then governed by fail-closed policy, evidence requirements, and rollback expectations before claims move beyond static or lab validation.
operational controls
Managing execution risk through trust boundaries.
Durable state isolation
Keeps persistent context and files inside bounded runtime state so reviewers can distinguish workload state from host state and audit what crossed a boundary.
Tool/data gates
Allows agents to process external data, invoke APIs, and ingest transcripts only through explicit tool/data policy, secret references, and auditable access paths.
Containment policy enforcement
Enforces default-deny network egress, deterministic runtime timeouts, and credential-by-reference access gates. The first egress, SSRF, and lateral-movement boundary is now adversarially measured; deeper boundaries stay pending until their own receipts exist.
current public architecture
Each layer assumes the one above can fail.
Policy and promotion boundary
Operator-approved changes move through explicit policy, dry-run/review expectations, fail-closed defaults, and recorded recovery evidence before stronger claims are made.
- operator-approved changes
- dry-run/review posture
- fail-closed defaults
OpenShell sandbox runtime
Hermes Agent runs inside an OpenShell sandbox with least-privilege runtime settings, rootless Podman isolation, and denied-by-default access outside the approved path.
- non-root workload
- no broad host socket access
- default-deny egress posture
Managed provider boundary
Model and tool-provider access is mediated outside the sandbox. Public evidence focuses on placeholder-in-sandbox credentials and fail-closed behavior on misroutes.
- secrets by reference
- managed inference path
- credential boundary receipt
Evidence and recovery overlay
Receipts, public-safe summaries, rollback expectations, and manual declassification review keep the architecture honest about what is measured versus still pending.
- sanitized receipts
- claim discipline
- recovery evidence
from designed to measured
Honest proof, not production theater.
The substrate skeleton is host-validated in a lab, and two boundary summaries are now measured in public form: the inner sandbox and the governed inference path. The sequence is still not finished, and it does not claim a turnkey managed platform, a production migration, or that every deeper containment boundary is proven.
Host-validated · current public shape
- 🖥️ NUC-class VM substrate hosts the sandboxed workload.
- 📦 OpenShell sandbox runs the Hermes Agent workload behind policy gates.
- 🔒 Rootless Podman posture keeps the runtime aligned with least privilege.
- 🔄 Recovery and rollback expectations are treated as evidence requirements.
Boundary-measured · adversarial
- 🛡️ Inner sandbox: egress refused at the proxy and under a raw-socket bypass.
- 🚫 SSRF, lateral movement, and external DNS refused; filesystem read-only; process non-root.
- 🔐 Inference boundary: provider credential stays outside the sandbox; misroutes fail closed.
⏳ Deeper containment claims remain separately scoped until their own public summaries exist.
Read boundary receipt #1 → Read boundary receipt #2 →grounded in primary research
Aligned with published sandboxing and isolation patterns.
Dual-Isolation Thesis
"Without network isolation, a compromised agent could exfiltrate sensitive files; without filesystem isolation, it could escape the sandbox."
The reference architecture maps this dual-isolation model to agent workloads by combining filesystem containment with default-deny network egress.
Anthropic Engineering (2025) →Host Defense Architecture
"By intercepting all sandboxed application system calls to the kernel, it protects the host from the application."
The substrate treats tool actions as boundary-crossing events and keeps host protection as an explicit design concern.
Google gVisor Platform →Minimal Attack Surface
"A minimal device model that excludes all non-essential functionality and reduces the attack surface."
The public architecture keeps VM containment as a separate backstop so the sandbox boundary is not the only line of defense.
AWS Firecracker microVM →reference workloads
Two workload shapes, one hosting contract.
Persistent agent workload
Long-running background agents promoted by immutable git commits, executing approved workflows within a dedicated, isolated environment.
Ephemeral task container
Short-lived sandboxed containers that spin up on demand for higher-risk scripts or raw-input processing, then tear down with residual state checks.
public docs and receipts
Current evidence first, reference specs clearly labeled.
Documentation index
00 — Overview
01 — Reference acceptance substrate
02 — Promotion control plane
03 — Reference gateway fixture
04 — Governance and claim discipline
05 — Gated preview access
Security methodology
Threat model
Verification model
Governed workload case study
Reference acceptance receipt
Boundary receipt #1 — inner sandbox
Boundary receipt #2 — inference boundary
