Architecture · 01 of 10 · Agent substrate

Agent execution substrate: sandboxed, scoped, disposable

Every agent task gets its own disposable environment. The broker decides scope, the claim creates it, and the only way out of the sandbox is the governed gateway.

Agent execution substrate: sandboxed, scoped, disposable Architecture showing an agent task becoming a per-session Crossplane claim that provisions an ephemeral namespace with a sandbox pod, a short-lived identity and default-deny egress, whose only route out is the MCP gateway, with a reaper deleting the namespace on TTL expiry. EPHEMERAL NAMESPACE · PER SESSIONTASKCLAIMCREATESDELETESMCPEVERY CALLAgent requesttask · repo · scopeAgent brokerauthz · quota · TTLAgentSession XRCrossplane claimTTL reaperdeletes namespaceSandbox podgVisor · read-only rootfsSession identityprojected SA · 30 min TTLEgress policy + quotadefault-deny NetworkPolicyMCP gatewayonly permitted egressAudit logappend-onlyThe agent holds an identity, not a credential.LEGENDIsolation unitIdentityPolicy · logLifecycleGoverned callProvisioning

Requirement

Design and run the execution environments agents work in: sandboxed, reproducible, permissioned, disposable.

Design choices

  • Identity per session, not per agent type: 30 minute TTL, scope derived from the task.
  • No route out except the gateway; no standing secrets inside the sandbox.
  • Namespace carries a TTL and finalizer; rebuildable from an image digest plus the task spec.

Evidence and gap

Built in Hangar: the claim-a-thing, get-a-governed-environment pattern (Crossplane XRs) and the Tower policy of no standing pod exec. Proposal only: gVisor or Kata runtime and per-session identity minting.

Hangar · reference architecture