---
title: 'Execution environments, identity & secrets'
description: "Default to isolated, ephemeral execution with scoped credentials and no production secrets in the model's reach."
canonical_url: 'https://darkfactory.dev/factory/execution-environments'
markdown_url: 'https://darkfactory.dev/factory/execution-environments.md'
collection: factory
date_published: '2026-07-16T00:00:00-04:00'
date_modified: '2026-07-16T00:00:00-04:00'
---

# Execution environments, identity & secrets


**Confidence: high.** *Evidence: production telemetry and case study.* *Last substantive change: 2026-07.*

Sandboxes, credentials, and runtime limits decide what an agent can do even when it makes a bad choice. Those boundaries must hold without help from the prompt.

## The conclusion

**Default to isolated, reproducible, short-lived execution with filesystem and network boundaries, scoped credentials, and no production secrets directly available to the model.** Containment is the last line of defense when verification and judgment fail, and it must be architectural rather than dependent on approval prompts.

## How the thinking got here

Local developer permissions gave way to per-action prompts, then to sandboxes, containers, and sealed virtual machines, then to credential brokers and containment matched to blast radius. The lesson that forced this progression is blunt: an irreversible action can complete faster than any human can intervene, so the boundary has to exist before the action, not after.

## Credible alternatives, and when each is right

| Approach | Right when |
|---|---|
| Host execution with approvals | trusted, owned, low-risk work |
| OS sandbox | light isolation is enough |
| Container | reproducibility and parallel safety |
| Sealed virtual machine | high-risk or untrusted code |
| Remote ephemeral environment | scale and clean-slate runs |
| Air-gapped or simulated environment | maximum blast-radius control |

## Where it fails and what we still don't know

Failures include an irreversible destructive action reachable without containment, covert channels, and secrets exposed to a context that can be injected. [Anthropic's first-party telemetry](https://www.anthropic.com/engineering/how-we-contain-claude) reports that users approved roughly 93% of permission prompts and argues for containment over approval fatigue; environment fidelity remains a practical trade-off. Open questions include sandbox-escape testing, dependency and network policy, identity attribution, and secretless workflows.

## What would change our mind

Evidence that human approval at production volume reliably prevents irreversible mistakes would soften the case for architectural containment. The current evidence points the other way.

## Evidence and further reading

- [NeuralTrust: post-mortem of the 9-second AI database deletion](https://neuraltrust.ai/blog/pocketos-railway-agent)
- [ActPlane: OS-Level Policy Enforcement](https://arxiv.org/abs/2606.25189)
- [Anthropic: How we contain Claude across products](https://www.anthropic.com/engineering/how-we-contain-claude)