Ubie keeps credentials out of its agent sandboxes and dropped its plan-build-verify pipeline

The article is in Japanese. We read it in full, and what follows is our summary, with no translated quotations. Kotani describes two systems: Remoco, a cloud agent platform that Ubie treats as the base for all company work, and Uvin, an engineering agent that runs on it. He says Ubie has built cloud agents in-house since 2023 and started Uvin in 2025 with a software factory as the goal.

The agent harness runs outside the sandbox. The agent loop runs on a Temporal worker, and only tool calls such as bash, read and write are handed to a sandbox. Kotani says this matches the design Anthropic has described as decoupling the brain from the hands, and lists three benefits: the agent keeps responding if a sandbox dies, agents that need no sandbox do not get one, and expensive sandbox disks can be cleaned up without losing the session.

Each session gets its own microVM, built on GKE Agent Sandbox with Kata Containers. Kotani says the sandbox contains no credentials, only placeholders. All outbound traffic passes through a proxy, and the proxy attaches a credential only when the destination is allowed. He says the rules go down to the path and the GraphQL operation, and gives one example: agents cannot write to GitHub outside Ubie's organization. Because of this, he writes, agents inside the sandbox work without approval prompts.

Access control splits agents into two kinds. A personal agent acts with the permissions its requester connected through OAuth and cannot be called from a shared place such as Slack. A team agent can be called from Slack and uses a service account chosen by who is able to see the session, checked on each tool call.

Uvin itself is an agent skill based on pstack, which Kotani says Cursor published. He says Ubie used to pass work from a Plan agent to a Build agent to a Verify agent, and dropped that for the stages from planning through verification. His reason is that product work loops back on itself, and that models of the Opus 5.5 generation orchestrate well enough to work from a playbook. A daily job also reads the previous day's sessions and opens pull requests to improve Remoco and Uvin. Ubie also uses CodeRabbit when it accepts Uvin's output.

The article gives no throughput, cost or defect figures, and it closes with a recruiting call. Kotani's post linking it showed 218 likes, 161 bookmarks and 11.3K views a little over three hours after he posted it on the evening of November 11.

Why it matters: The proxy design answers a question every team running unattended agents has to settle, which is where the credentials live. Ubie attaches them at the network edge with rules scoped to the operation, and says that is the reason its agents can run without approval prompts. The pipeline decision is weaker evidence. Kotani says the skill-based approach gives good enough results, and the article does not measure it against the pipeline it replaced.