Foundations — Issue 49

Policy as Craft

The Document Nobody Wants to Write

By Sable Whitford— October 1, 2026

Feature image for article: The Document Nobody Wants to Write

Agent security policy has to do three things at once: be precise enough for a machine to enforce on every request, loose enough that the agent can still finish its task, and clear enough that a human can reconstruct what was allowed after something goes wrong. Most of the conversation about agent security is about the enforcement runtime — sandboxes, isolation boundaries, network proxies. But the runtime does what the policy tells it to do. The consequential decisions live in the document, and writing that document is a kind of technical writing we don't have practice for yet.

Policy as Craft

The Document Nobody Wants to Write

By Sable Whitford— October 1, 2026

Agent security policy has to do three things at once: be precise enough for a machine to enforce on every request, loose enough that the agent can still finish its task, and clear enough that a human can reconstruct what was allowed after something goes wrong. Most of the conversation about agent security is about the enforcement runtime — sandboxes, isolation boundaries, network proxies. But the runtime does what the policy tells it to do. The consequential decisions live in the document, and writing that document is a kind of technical writing we don't have practice for yet.

Policy in Practice

How OpenShell's Policy System Turns Denials Into Evidence

By Sable Whitford— October 1, 2026

Feature image for article: How OpenShell's Policy System Turns Denials Into Evidence

Every time something inside an OpenShell sandbox runs into a boundary — a denied outbound request, a blocked path, a credential that won't resolve — the system writes it down. This walkthrough follows those records through the four independent policy domains, the Policy Advisor path that lets an agent propose its own permission expansions with a risk assessment attached, and what happens to live connections when the rules change underneath a running agent. Then the part people skip: where the records go.

Policy in Practice

How OpenShell's Policy System Turns Denials Into Evidence

By Sable Whitford— October 1, 2026

Every time something inside an OpenShell sandbox runs into a boundary — a denied outbound request, a blocked path, a credential that won't resolve — the system writes it down. This walkthrough follows those records through the four independent policy domains, the Policy Advisor path that lets an agent propose its own permission expansions with a risk assessment attached, and what happens to live connections when the rules change underneath a running agent. Then the part people skip: where the records go.

Further Reading

The NCSC's Seven Considerations for Agentic AI: Maturity Models, Sandbox Design, and the Pull-the-Plug ProblemThe UK's cyber authority lays out an operational security framework for agent deployments, with real specificity.

If You Cannot Contain It, Do Not Deploy It: The NCSC's Joint Guidance on Agentic AI AdoptionSix-nation guidance on least privilege, temporary credentials, and human accountability for autonomous agents.

Quick links

Reading the NCSC Guidelines as an Enterprise Practitioner

Policy Dimensions

A sandbox that only controls one surface — say, network access — leaves every other surface wide open. Filesystem traversal, credential leakage, privilege escalation, unauthorized model routing: each is a distinct failure mode that requires distinct enforcement and has distinct blind spots.

NVIDIA's OpenShell, open-sourced in late September 2026, publishes a five-dimension policy architecture that makes these boundaries explicit. The interesting details are operational: which controls are locked at startup versus reloadable live, where credentials actually live relative to the agent process, and what happens when an agent hits a wall. The gaps between dimensions matter as much as the dimensions themselves.

Policy Dimensions

A sandbox that only controls one surface — say, network access — leaves every other surface wide open. Filesystem traversal, credential leakage, privilege escalation, unauthorized model routing: each is a distinct failure mode that requires distinct enforcement and has distinct blind spots.

NVIDIA's OpenShell, open-sourced in late September 2026, publishes a five-dimension policy architecture that makes these boundaries explicit. The interesting details are operational: which controls are locked at startup versus reloadable live, where credentials actually live relative to the agent process, and what happens when an agent hits a wall. The gaps between dimensions matter as much as the dimensions themselves.

Filesystem Controls

Path Restrictions Lock at Startup and Stay Locked

OpenShell uses Linux Landlock to restrict which paths an agent can read or write. Rules apply at sandbox startup and are immutable after that. If someone later mounts sensitive data into an allowed path, Landlock has no opinion — the rules were already set.

Network Controls

Default-Deny Proxy Inspects Every Outbound Request

All outbound traffic routes through a proxy that checks destination, port, calling binary, and optional HTTP-level rules. Cloud metadata endpoints are unconditionally blocked. Unmatched requests get denied. Unlike filesystem policy, network rules can be hot-reloaded without restarting the sandbox.

Process Controls

Agents Run Unprivileged With Stripped Linux Capabilities

The supervisor starts agents as unprivileged users with reduced capability sets, blocking privilege escalation and privileged child processes. The UK NCSC points out that kernel-level process isolation still carries residual breakout risk — higher-risk workloads may need VM or hardware boundaries.

Credential Controls

Raw Secrets Never Enter the Agent Process

The proxy injects credentials into outbound requests so the agent never sees raw secrets. When a policy change would expand authenticated reach to new endpoints, a formal prover flags it and routes the proposal to a human review queue before anything activates.