The safeguards map / 3.1 Execution sandboxes
Agent Substrate
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A zero-trust runtime for sandboxed agents on Kubernetes, with microVM and gVisor sandboxes and egress filtering that can call out to external authorization services.
Where it sits
3.1 Execution sandboxes (primary): Runs agents as actors in microVM or gVisor sandboxes and filters their ingress and egress, with an egress proxy that can call external authorization services.
Agent Substrate is a security-hardened, zero-trust runtime for sandboxed agents
captured
It supports multiple sandbox technologies, including microVMs and gVisor
captured
Operators can either extend the existing egress proxy using Envoy's `ext_proc` callout mechanism to invoke external inspection and authorization services
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- agent
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- an external decision point
- Can the agent bypass it
- depends
Handoffs
None recorded. A mapped entry with no handoff is here for its foundation home.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.