What a per-agent sandbox actually buys you

Isolation is the most overloaded word in infrastructure marketing. It can mean a separate database row, a separate container on a shared kernel, or a separate machine. Those are wildly different promises, and only one of them survives a bad day.

So rather than claim isolation, here is the actual boundary an agent runs inside on Diali, and what it is designed to stop. The short version lives on the security page; this is the longer one.

What each agent gets

Every agent runs alone. Not one process among many in a shared runtime, but its own workload with its own boundary:

• Its own gVisor sandbox, which puts a user-space kernel between the agent's syscalls and the host.
• Its own namespace and service account, so nothing it holds is addressable from another agent.
• Its own network policy: no public ports, and outbound access to the public web only, never to our internal network, the cloud metadata server or other tenants.
• Its own storage, encrypted at rest with keys we manage in Google Cloud KMS.

The reason for the syscall boundary in particular: agents run code. They install packages, execute commands, and use a full command line. Treating that as untrusted from the start is cheaper than deciding later which of the command-line tools preinstalled on every agent were the dangerous ones.

The threat we actually designed against

The scenario that drove these choices is not a nation-state attacker. It is much more ordinary: an agent installs a skill, or reads a web page, and that content tries to make it do something it should not. Prompt injection is not exotic, it is the normal weather for anything that reads the internet.

You cannot make an agent immune to bad instructions. You can make sure the blast radius of following one stops at its own sandbox.

That is the whole design goal. If an agent is talked into running something hostile, the damage is bounded by what that one agent could reach anyway: its own workspace, its own credentials, its own allowlisted destinations. Not your other agents, and not anyone else's.

Where it runs, and where it does not

All of it sits on Google Cloud in europe-west1, in Belgium, and it is not moved out of the EU. Deleting an agent destroys its workload, its storage and its secrets. That last part matters more than it sounds: an isolation story that leaves data behind after deletion was never really about isolation.