Agent access control and security is top of mind for many leaders as we hear about Agents hacking company infrastructure. Here is a quick post of how I see a layered architecture to secure agent execution.
a) An agent runs unreviewed code and decides at runtime which files to read and which hosts to call. For example if a web page contains a prompt injection it can tell the agent to read the SSH keys on the host and send them out. A sandbox creates an isolation boundary to avoid this. It does this by implementing filesystem and process controls, network proxy, credential broker and resource limits.
b) A container shares the host kernel so a kernel exploit inside the container reaches the host. A microVM gives each sandbox its own guest kernel on KVM and thus creates an additional layer to protect the host.
c) NVIDIA OpenShell is a sandbox built for agents. The agent runs as a normal user and can only reach the folders you allow. Every outbound call goes through a proxy that blocks everything until you add a rule. For example a rule can let the agent read from the GitHub API and still block it from creating issues. OpenShell can also run each sandbox in its own microVM and it keeps the keys outside the sandbox so the agent never sees them.
d) CPU access in a microVM is straightforward. Each vCPU is a KVM thread on the host so cgroups and CPU pinning control how much CPU a sandbox gets.
e) GPU access in a microVM is the hard case. The usual way is VFIO passthrough which hands the whole GPU to the microVM so the NVIDIA driver runs inside it. The hardware makes sure the GPU can only reach the memory of that one microVM. Firecracker only recently started supporting this so GPU sandboxes usually run on Cloud Hypervisor or QEMU.
f) Passthrough is expensive for agents. The guest memory is pinned at boot so you lose memory oversubscription and the sandbox holds a whole GPU. For example if an agent session runs for 3 hours then the agent may use the GPU for only 10 minutes. Then in this example the sandbox holds a full GPU for 180 minutes to do 10 minutes of work.