What does containment consist of?
Walls at four layers. Execution: the agent’s code and commands run in sandboxed code execution, isolated from production hosts. Access: credentials are scoped and short-lived, per least privilege for AI agents, so the agent holds only its task’s rights. Network: the agent reaches named services, not the internet at large. And termination: a tested agent kill switch that stops the agent and revokes its credentials everywhere at once. The design question is the worst case, not the average case: what is the most this process could do if it were fully adversarial, and is that acceptable.
How does containment differ from monitoring and guardrails?
It is the layer that works when they fail. Guardrails classify and block actions in flight, monitoring detects trouble after it starts; both are probabilistic and both can be evaded by a manipulated agent. Containment is deterministic: a capability that was never exposed cannot be exercised, whatever the prompt injection said. Security framing borrows the reliability term blast radius: guardrails lower the probability of a bad action, containment caps its size. Spend on containment in proportion to what the agent touches, because it is the only control whose guarantee does not depend on the model behaving.
What should a team do first?
Inventory, then walls, then drills. List every agent and what it can currently reach, which is usually more than anyone intended; move execution into sandboxes and cut credentials to task scope; put external, untrusted content behind stricter walls than internal data, since injected instructions are the common entry; and rehearse the kill switch, because a stop mechanism nobody has tested is a hope, not a control. Containment also simplifies audits: a reviewer who can read the walls does not have to trust the agent’s judgment, only the configuration.