Architecture · 01 of 10 · Agent substrate

Agent execution substrate: sandboxed, scoped, disposable

Every agent task gets its own disposable environment. The broker decides scope, the XR creates it, and the only way out of the sandbox is the governed gateway.

Agent execution substrate: sandboxed, scoped, disposable Architecture showing an agent task becoming a per-session namespaced Crossplane XR that provisions an ephemeral namespace with a sandbox pod, a short-lived identity and default-deny egress, whose only route out is the MCP gateway, with a reaper deleting the namespace on TTL expiry. EPHEMERAL NAMESPACE · PER SESSIONTASKAPICREATESDELETESMCPEVERY CALLAgent requesttask · repo · scopeAgent brokerauthz · quota · TTLAgentSessionnamespaced XRTTL reaperdeletes namespaceSandbox podgVisor · read-only rootfsSession identityprojected SA · 30 min TTLEgress policy + quotadefault-deny NetworkPolicyMCP gatewayonly permitted egressAudit logappend-onlyThe agent holds an identity, not a credential.LEGENDIsolation unitIdentityPolicy · logLifecycleGoverned callProvisioning

Problem

Agents need somewhere to work that is sandboxed, reproducible, permissioned and disposable.

Design choices

  • Identity per session, not per agent type: 30 minute TTL, scope derived from the task.
  • No route out except the gateway; no standing secrets inside the sandbox.
  • Namespace carries a TTL and finalizer; rebuildable from an image digest plus the task spec.

Evidence and gap

Built in Hangar: the request-a-thing, get-a-governed-environment pattern (Crossplane XRs) and the Tower policy of no standing pod exec. Proposal only: gVisor or Kata runtime and per-session identity minting.

Hangar · reference architecture