Agent Host Isolation

Procedure

Step 1: Define the protection boundary.

1. Identify the task, expected commands, required inputs, expected outputs, and every intended side effect.
2. Treat model output, web content, repository content, dependencies, and generated artifacts as untrusted input.
3. Read references/boundary-model.md and classify every protected asset and capability.
4. Do not use a prompt, approval dialog, or tool description as the sole protection boundary. Record it only as a supplementary control.
5. Copy assets/isolation-manifest.template.json to a task-specific manifest. Deny every unspecified capability.

Step 2: Select the execution host.

1. Use an in-memory or restricted interpreter only for deterministic inspection, search, formatting, and other operations that require no arbitrary native binary execution.
2. Use a short-lived guest VM for dependency installation, builds, tests, generated code, or arbitrary binary execution.
3. Do not treat an interpreter, a container label, or a human approval hook as equivalent to a guest-VM boundary.
4. Keep the control plane on the host only when it must retain interactive authentication or policy authority. Keep the execution plane in the selected restricted host.
5. Read references/execution-profiles.md before selecting a profile other than inspect or guest-build.