ISOLATED EXECUTION
Aagent-a
Bagent-b
Cagent-c
Separate memory. Explicit access.
A workspace of its own.
Run agent tools in a WebAssembly sandbox with permissions scoped to the task.
THE INFRASTRUCTURE BEHIND THE INTELLIGENCE
Let your agents work.
Keep control of what matters.
From a tool call to a finished task. Run agents in isolated workspaces, give them explicit permissions, and keep every next step in view.
From intent to evidence
A useful result. An explicit next step.
Follow a release review from scoped file access to a proposed change. The agent can inspect the configuration; publishing still needs your decision.
J
Review the release configuration.
Tell me what needs attention before we publish.
EXECUTION
Task receivedrelease-review
Read scope verifiedread_file · /app
Configuration inspectedrelease.json
Review preparedNo changes published
Isolated workspaceScoped to this run
release.jsonRead only
1
{2
"service": "release-worker",3
"runtime": "wasm",4
"environment": "preview",5
"permissions": ["read:config"]6
}Configuration reviewed.
The worker is isolated, and its scope permits configuration reads.
Ready for a publishing decision.
A review is complete. A release is a separate action.
Agents make decisions.
Your infrastructure should make their limits clear.
Designed around the workload
Give autonomy a place to run.
Execution, authority, and context belong in the same operating model. Give each agent a defined workspace and make its work inspectable.
SCOPED AUTHORITY
release-reviewRead configIn scope
Publish releaseApproval required
Every permission has a purpose.
Keep the authority to inspect separate from the authority to change production.
OBSERVABLE WORK
01
scope.checked02
config.inspected03
review.preparedrun / release-review3 events
A record you can follow.
Keep actions, decisions, and results in context when a run needs a closer look.
One platform.
The pieces your agents need.
Start with an isolated tool. Add the services the application needs as its responsibilities grow.
Portable execution
Package the work in WebAssembly. Give it a runtime designed around isolation.
Scoped credentials
Define the tools and resources each workload can access.
Connected services
Bring storage, events, and background work into the same application.
Operational context
Follow execution and investigate the record behind the result.
THE NEXT STEP IS YOURS
Make the idea
an operating agent.
Bring a workload. Define its boundaries.
Build from there.