What is Containment?
Governance & ControlLimiting what a compromised or malfunctioning agent can reach and do. Not network isolation: containment for agents means bounded credentials, bounded tools, and a bounded budget: the incident-response vocabulary for autonomy.
Why It Matters
Anthropic’s framing splits agent safety into supervision and containment, and the distinction carries the whole argument. Supervision watches what the agent does and approves it; containment limits what the agent can reach at all. Supervision degrades under load because reviewers fatigue. Containment does not degrade: a boundary the agent cannot cross stays a boundary at request one and request ten thousand. If credentials never enter the sandbox, they cannot be exfiltrated, whether the cause is a confused model, a malicious user, or an attacker. The most effective governance control is the one that makes the violation impossible rather than detected.
The Anthropic Progression
Claude Code’s own history shows the trajectory. It launched with per-action approvals: reads allowed, writes gated, network denied, and approval fatigue appeared within weeks. The next step was an OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) where writes are allowed inside the workspace and network is denied by default, cutting permission prompts by 84%. For Claude Cowork the boundary became a full virtual machine with its own kernel and filesystem: the user’s workspace is mounted, nothing else on the host is visible, and credentials stay in the host keychain and never enter the guest. Each step moved a class of decision from human judgment to hard boundary.
Where It Breaks
The common mistake is treating containment as network isolation and stopping there. An agent inside a sandbox holding production credentials is contained in name only: the wall limits where code runs, not what the agent can reach. The other failure is containment without an interior: bounding the environment but leaving supervision, policy, and audit out of it, so the agent is boxed in but unobserved inside the box. Containment sets the outer boundary; the policy engine and the auditor handle what happens within it.
How Flytebit Handles It
Containment in our deployments is layered: environment-scoped credentials that cannot name resources outside their scope, tool surfaces limited to what the task requires, and spend bounds that cap the run. Inside the boundary, runtime governance handles the judgment calls. The full containment-versus-supervision argument is in Governing Agentic AI, and the engagement version is our AI governance and risk work.