# Agent execution substrate

The isolated, stateful environment in which agents observe and act, including compute, filesystem, browser, network, credentials, resource limits, and session lifecycle.

core-concept · Harness & runtime · emerging · Reviewed 2026-08-09

## Definition

The isolated, stateful environment in which agents observe and act, including compute, filesystem, browser, network, credentials, resource limits, and session lifecycle. The workspace, browser, shell, network, and identity are part of the agent—not background infrastructure.

Sandboxing is established; agent-specific substrates are still taking shape.

## Why it matters

The workspace, browser, shell, network, and identity are part of the agent—not background infrastructure.

The operating shift is from “Run the model somewhere” to “Engineer the place where action occurs.”

## System anatomy

- **Practice 1:** Isolate work by task and identity
- **Practice 2:** Constrain network, secrets, and resource use
- **Practice 3:** Capture environment transitions as evidence



## Important distinctions

- **Run the model somewhere:** This concept moves the engineering system toward engineer the place where action occurs.



## Implementation signals

- Isolate work by task and identity
- Constrain network, secrets, and resource use
- Capture environment transitions as evidence

## Failure modes

- Hidden environmental side effects
- Shared credentials and unbounded egress



## Related knowledge

- [Harness engineering](https://aisdlc.ai/agentic-engineering/harness-engineering) — Engineering the agent loop, task decomposition, tools, permissions, session state, checks, retries, feedback, checkpoints, and stop conditions that surround a model.
- [Agent identity & delegated authority](https://aisdlc.ai/agentic-engineering/agent-identity) — The identity and authorization discipline that treats an enterprise agent as a non-human principal with attributable, purpose-bound, time-bound permissions.
- [Observability & control](https://aisdlc.ai/agentic-engineering/observability-control) — The combined telemetry and enforcement architecture for tracing agent behavior, evaluating policy, obtaining approval, constraining action, revoking authority, quarantining execution, and stopping systems.

## Sources and further study

- [Google Cloud — Agent Sandbox on GKE and Agent Substrate](https://cloud.google.com/blog/products/containers-kubernetes/bringing-you-agent-sandbox-on-gke-and-agent-substrate) — An agent-specific execution architecture emphasizing isolation, state, scheduling, and environment control. **Use:** First-party case study. **Limitation:** This first-party account documents one organization, product, or implementation context and should not be generalized without local evidence.
- [OpenAI — Harness engineering: leveraging Codex in an agent-first world](https://openai.com/index/harness-engineering/) — A production case study in designing repositories, tools, feedback loops, and environments for agent-first delivery. **Use:** First-party case study. **Limitation:** This first-party account documents one organization, product, or implementation context and should not be generalized without local evidence.
- [OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) — A threat-oriented reference for goal hijacking, tool misuse, identity abuse, memory poisoning, and cascading agent failures. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

---

This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.