Agents that can act must be contained

You can have an open-source agent running on a laptop this afternoon. It will read files, call APIs, write code, and it will feel like the future.

Then someone suggests pointing it at the company's systems, and the real work begins.

The defaults were built for one person

The agent tooling everyone is installing ships with single-user defaults. Full file access. Open network. No audit trail. On one developer's machine that is convenience. In a company that handles customer data or financial records, the same defaults are a list of things you will explain in an incident review.

Nothing is wrong with the tools. They were built for a different situation than yours.

Guardrails first, agents second

The order matters more than the model. Before an agent does anything useful, decide what it cannot do.

Deny by default. Each permission is granted per agent, on purpose, and written down in a policy you can version and review. Secrets are scoped to the job. Traffic leaving your perimeter is controlled. Sensitive data stays inside.

And everything the agent does is logged. Not because you expect it to misbehave, but because "what did it do last week?" is a question you will be asked, and "we do not know" is not an answer.

Start with one workflow

Do not deploy a fleet. Deploy one agent on one scoped workflow, behind the policies, and watch it.

This is where the guardrails prove themselves. You will find the permission you forgot, the alert that fires too often, the step where a human should still decide. Fix those on one workflow. Then widen.

Teams that skip the pilot do not move faster. They discover the same problems later, on more systems, with more at stake.

When something breaks

It will. The question is what happens next.

A contained agent that tries something outside its policy is blocked at runtime. An alert fires. A playbook says who does what. That is a boring afternoon.

An uncontained agent that does the same thing is a story you tell for years.

The point

An agent that can only talk is a demo. An agent that can act is infrastructure, and infrastructure has rules. Put the rules in first.

If you are about to give agents access to real systems, bring us the setup before you do.