Why we built a sandboxed runtime for AI agents
Prompts are not a security boundary. The architecture we landed on after six months in production: V8 isolates, capability-scoped tools, kill-switches, observability.
Author
Head of Engineering
Former Datadog principal engineer. Runs our agent runtime team. Has strong opinions about queues and observability.
Writing
Prompts are not a security boundary. The architecture we landed on after six months in production: V8 isolates, capability-scoped tools, kill-switches, observability.
Single-tenant feels safer. We argue, with the threat model in hand, that the opposite is true for agent workloads.
How we run 12,000 eval cases on every PR — and what we do with the cases that flake.
Engineering, research and product notes from the team building ai-agents.bar.