Codex and Claude Code run on my Mac as me. Same user, same SSH keys, same kubeconfig, a password store one pass show away. They are careful with all of it. They are also getting more autonomous every month, and I supervise them less every month, and those two lines don’t cross anywhere good.
The instinct is to treat this as an AI problem: smarter models, better alignment, more careful prompts. I think it’s an infrastructure problem, and infrastructure has solved this shape before. We didn’t make strangers trustworthy before renting them compute; we built VMs. We didn’t audit every dependency before running other people’s code in production; we bounded what a container could do. Each time, the isolation primitive arrived first and the workload class exploded after. The answer to “this code might do something I don’t want” has always been isolation cheap enough to be the default.
Agents are the next tenant class, and the first one that chooses its own next action, which sharpens the isolation question. Right now most of us run it the way we ran everything before VMs: as ourselves, on our own machines, with a prayer.
The layer that won’t churn
At GTC this year NVIDIA announced NemoClaw, a collection of open blueprints for building autonomous agents. The stack is three layers: a harness (OpenClaw by default, Hermes and LangChain Deep Agents supported), a model (Nemotron, by default), and a runtime. The harness layer is a knife fight, every framework in it rewritten monthly. The model layer is whatever won benchmarks this quarter. Both are swappable by design, which tells you what NVIDIA thinks of their shelf life.
The runtime is OpenShell, and it answers the question that will look the same in five years: how does an agent execute code and touch the network without inheriting your identity? The runtime is the contract between an agent and the world, and contracts outlive both harness and model.
The design, compressed: a gateway owns state, policy, and credentials; a supervisor inside every sandbox launches the agent as a restricted child process; Landlock under the filesystem in best-effort mode, OPA in front of the network, default-deny on egress. On Kubernetes, a sandbox is a custom resource. Agents become workloads the same way services did, and everything the last fifteen years built for workloads (scheduling, quotas, monitoring, replicated storage) is sitting there waiting to be wired to them. My alert when a sandbox wedges arrives through the same Prometheus and Alertmanager that watch everything else in my cluster.
Gateway, two agent pods with their own workspaces, one NetworkPolicy.
Trust becomes a file you can diff
Today, trust in an agent mostly reduces to one decision: it runs as you or it doesn’t. There are approval prompts and per-tool sandboxes on top, but the process holds your identity, and everything you can reach is one bypassed prompt away.
Under a policy runtime, trust is a YAML document: these hosts, for these binaries, with these credentials, on these paths. It can be reviewed, versioned, diffed, revoked. And OpenShell’s policy has a property I hadn’t seen before: it’s binary-aware. In my sandboxes, api.anthropic.com is reachable by the claude binary and whatever it spawns, and by nothing else in the pod; a bare curl to the same host dies at the proxy. Permission attaches to a tool and its process tree, not to the machine. That’s a different species of statement than a firewall rule, and it’s the primitive you’d want when the thing choosing which tool to invoke is itself a model.
The whole trust matrix of one sandbox, one line per rule. github.com appears twice with different binaries: once for git, once for copilot.
The same policy, measured from inside by the agent itself. api.openai.com is blocked here because the asker is claude: the codex rule doesn’t apply to it.
OpenShell also lets agents propose policy changes, which land in a review queue instead of failing silently. Follow that line: the agent negotiates its own permissions, a human (or a stricter agent) approves the diff, and the audit trail is the git history of a policy file. Access control starts to look like code review.
Delegation needs a bounded downside
What stops me from letting an agent run overnight isn’t capability; current models could do useful unsupervised work for eight hours. It’s the unbounded worst case: an agent with my identity that goes sideways at 3am has my keys, my infrastructure, and seven hours of runway before I notice.
Cap the worst case and the calculation flips. A sandboxed agent that goes sideways at 3am can exhaust 2 CPUs, fill its own workspace volume, and talk to the short list of hosts its policy names, using credentials that can’t leak anywhere the policy doesn’t already allow. Bounded is not harmless (an allowed host can still be misused with the credential it was granted), but a blast radius known in advance is the property delegation needs. Every autonomous system we already rely on (cron, CI, autoscalers) earned its autonomy the same way.
A sandbox that costs nothing to destroy also changes how you use agents. Spawn five on the same problem, keep the best diff, delete the rest. Give a half-trusted agent a real task, because the downside is a deleted pod plus whatever fit through the allowlist, not a compromised laptop. The unit of agent work stops being “a session I babysit” and becomes “a workload I dispatch.”
What actually runs today
I deployed OpenShell on my five-node k3s at home. Version 0.0.101; the chart README calls the Kubernetes path experimental and the docs say “Do not use it in production.” They mean it. The night was a parade of paper cuts: stale install links, a base image thirty agent-versions old, credentials surfacing under the wrong env var names. Plus one genuine bug, where a supervisor that loses its auth token retries forever (23,271 attempts when I found it) precisely because the hardened mTLS topology masks the error code that would trigger recovery. And the credential story is younger than the docs admit: for git providers the raw token still lands in the sandbox’s environment, so the real confinement is the default-deny network, not secrecy. The pothole map is a post of its own.
Little of it was structural; the credential gap is the one I’d call a broken contract rather than a paper cut. After one stubborn night, this is what runs: from anywhere on my tailnet, one command drops me into a current Codex on my own subscription, in a capped pod on the cluster, cloning private repos from my three git remotes through a whitelisted network. A second, long-lived sandbox holds a logged-in Claude Code whose credential survives pod restarts on replicated storage; that one is the exception to the gateway-holds-everything model, because the claude-code provider only accepts API keys and I’m on a subscription. The Codex OAuth tokens were handed to the gateway once, and its refresh worker keeps them rotated; the static git tokens are still my problem. If a supervisor wedges, my phone buzzes.
I asked the agent where it was running and what it could do: no sudo, writes rejected outside /sandbox, one interface behind a forced proxy. The 6 CPUs and 23 GB are the node’s numbers; the pod’s caps (2 CPU, 4Gi) live in cgroups, which don’t rewrite /proc.
The gateway’s view: four providers, credentials masked, and a sandbox with pending policy proposals waiting for review.
The clearest way to say what changed is what the agents lost in the move: my SSH keys, my kubeconfig, my password store, my filesystem, and the ability to install anything outside their own scratch volume. What I lost: git push to GitHub and npm inside the sandbox, both policy gaps I haven’t closed yet.
Tonight I find out what that’s worth: one agent, one repo that matters, running while I sleep. Worst case, I delete a pod in the morning.