Deterministic containment

Definition

The enforcement envelope outside the model: isolation, deny-by-default access, typed allowlists, quotas, transaction ceilings, network boundaries, timeouts, rollback, quarantine, and tested stop controls. Probabilistic decisions must terminate inside deterministic boundaries.

Isolation and policy primitives are established; agent-specific containment architectures are still converging.

Why it matters

Probabilistic decisions must terminate inside deterministic boundaries.

The operating shift is from “Ask the model to be careful” to “Make unsafe effects mechanically unreachable.”

System anatomy

Practice 1

Default-deny tools, data, network, and credentials

Practice 2

Validate every consequential action before effect

Practice 3

Exercise rollback, quarantine, and kill paths independently

Important distinctions

Ask the model to be careful

This concept moves the engineering system toward make unsafe effects mechanically unreachable.

Implementation signals

• Default-deny tools, data, network, and credentials
• Validate every consequential action before effect
• Exercise rollback, quarantine, and kill paths independently

Failure modes

• Natural-language guardrails used as the only boundary
• A kill switch sharing the same compromised control path

Sources and further study

1. Google Cloud — Agent Sandbox on GKE and Agent Substrate

   An agent-specific execution architecture emphasizing isolation, state, scheduling, and environment control.

   Use in this library: First-party case study. This first-party account documents one organization, product, or implementation context and should not be generalized without local evidence.

   engineering · engineering · Published 2026-05-20
2. OWASP GenAI Security Project — State of Agentic AI Security and Governance 2.01

   A current threat and governance synthesis covering instruction-data confusion, containment gaps, autonomous action, and agentic incident readiness.

   Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

   guidance · guidance · Published 2026-06-01
3. Open Policy Agent — OPA Management APIs and Architecture

   An established policy-engine architecture for distributed enforcement, centrally managed policy bundles, decision logs, and enforcement telemetry.

   Use in this library: Standard or protocol. A specification defines an interface or control pattern; conformance alone does not establish authorization, security, or fitness for a use case.

   standard · standard · Published 2026