Reliability & Safety for Agent Builders: 3-Ring Containment Guide
SRE outage-containment primer: an availability incident and a containment breach frequently share the same root cause (unbounded loops, over-scoped credentials, and unisolated tool execution). For dedicated AppSec risk scoring and OWASP Agentic governance, visit our sister publication agentssafety.com.
Interactive 3-Ring Agent Containment Architecture
Prompt filters alone are probabilistic and can be bypassed under adversarial input. Production agent platforms layer deterministic identity and kernel isolation around every model loop (see our sister publication agentssafety.com for full OWASP Agentic risk scoring). Select each ring to inspect its controls.
Ring 1: Input Taint Separation & Structured Tool Policy
Application & Orchestrator Boundary (OWASP ASI01 / LLM01)
Primary failure mode contained: Indirect prompt injection carried inside retrieved web pages, emails, tickets, or MCP resource payloads attempting to hijack tool invocation.
- Enforce strict JSON-Schema / typed grammar validation on every tool-call argument before execution.
- Separate untrusted retrieved data channels from system instructions and mark external text as tainted context.
- Block dynamic arbitrary URL construction in read-only retrieval tools to prevent prompt-driven data exfiltration.
- Cap maximum reasoning-loop iterations (for example 8 tool turns) and token spend per run to stop runaway loops.
# Policy rule: deny high-impact tool calls when context carries untrusted retrieval taint
rule deny_tainted_external_send {
when {
tool.name in ["send_email", "initiate_transfer", "delete_record"]
context.contains_untrusted_retrieval == true
approval.human_verified == false
}
action = "REQUIRE_HUMAN_APPROVAL"
}Workload Sandbox Isolation Comparison (Code-Executing Agents)
| Sandbox Runtime | Kernel / Memory Boundary | Typical Cold Start | Recommended Agent Workload |
|---|---|---|---|
| Firecracker MicroVM (KVM) | Hardware virtualisation + dedicated minimal Linux guest kernel per task | ~125 ms | Untrusted Python/Bash/Node code interpreters and autonomous repo-execution agents |
| gVisor (runsc User-Space Kernel) | Intercepts guest syscalls in a memory-safe user-space kernel without full VM overhead | ~50 to 100 ms | Kubernetes multi-tenant agent workers needing OCI container compatibility |
| Wasmtime (WebAssembly + WASI) | Capability-zero linear memory sandbox; zero host filesystem or socket access unless explicitly granted | < 5 ms | High-density deterministic plugins, data parsers, and single-function MCP tools |
| Unconfined Shared-Kernel Docker (Anti-Pattern) | Linux namespaces/cgroups sharing the host kernel syscall surface | ~200 ms | Not recommended for LLM-generated code execution due to kernel escape & lateral-movement risk |
Reviewed by Nadia Lindqvist, Lead Reliability & Agent Systems Editor
Reviews MicroVM agent sandboxing, OAuth 2.0 token scoping, and OWASP GenAI controls.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- OWASP Top 10 for Large Language Model Applications & Agentic Security Initiative (OWASP GenAI Security Project, 2025 Release)
- NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0) (National Institute of Standards and Technology, NIST Standard)
- Firecracker: Lightweight Virtualization for Serverless Applications (NSDI Paper & Docs) (Firecracker Open Source Project, KVM MicroVM Architecture)
Get Containment & Reliability Updates
Agent Uptime & Failover Post-MortemsStore your email for quarterly engineering briefings on agent sandboxing, MCP authorization hardening, and verified outage lessons. No emails are sent yet.