AI agent security is a runtime problem dressed up as a governance problem. Policies matter. They do not contain a shell the model just wrote.
The three failures we keep seeing
- Shared-kernel multi-tenancy — density looks cheap until one escape is everyone's problem
- Keys on the host — platform or sibling processes can see what the agent uses
- No rebuild story — when something goes wrong, there is no clean guest to reprovision
Enterprise whitepapers that skip those three are theater.
A practical stack
| Layer | Job |
|---|---|
| Hardware / microVM | Tenant boundary |
| Guest OS + user | Least privilege inside the box |
| Tool / MCP allowlist | Cap actuators |
| BYOK | No middleman ledger for models |
| Snapshot / destroy | Recover without archaeology |
jurniti implements the top and the recover loop as the product: one Firecracker guest per tenant, harness catalog, flat monthly plans.
Prompt injection is not "solved" by isolation
Isolation limits damage. It does not make every tool call wise. Keep human approval on irreversible actions (send, pay, prod ship). Pair runtime isolation with product gates — see GTM templates that never auto-send.
Related deep dives
$25/mo starts, BYOK, 30-day money-back first purchase. No free tier.