The autonomous employee was initially described as a tireless colleague. The infrastructure team described it as a process requiring isolation. Both teams were discussing the same product.
Docker’s Sandboxes offering describes isolated microVM environments for coding agents, with controls around the workspace and access to the surrounding system. The design is an example of the effort to give capable agents room to operate without giving them unrestricted reach. Product isolation claims are not guarantees against every failure mode.1
Freedom to do what, exactly?
An agent can be allowed to edit a project without being allowed to edit every project. It can run tests without having access to every credential. It can prepare a change without being allowed to publish it.
List what the task requires, then grant that access. “Autonomous” is an adjective; it is a poor permissions policy.
Less access can enable more useful autonomy. This is an awkward fact for a marketing vocabulary that treats every restriction as friction.
The boundary has doors
Isolation does not mean nothing enters or leaves. A coding agent may need source files, dependencies, network access, and a way to return its work.
Each connection matters. A mounted workspace is a deliberate opening. A network permission is another. Secrets supplied to the environment remain secrets that need appropriate handling. A sandboxed process can still do undesirable things with resources it has legitimately been given.
Inspect what crosses the boundary: files in, dependencies downloaded, work returned. The sandbox still has doors, and somebody chose where to put them.
A colleague metaphor with an operating manual
The difference is that the employee metaphor can cause users to assume a model understands unstated institutional rules. A system may instead need those rules expressed and enforced through the tools around it.
A powerful assistant that knows exactly where it can work may be more dependable than one offered a broad mission and an assortment of credentials. The second can look more impressive until the operator needs to explain why it touched an unrelated file.
Reversibility is underrated
A proposed patch can be reviewed. A test can run against the result. A deployment can remain a separate decision. These stages make it possible to distinguish productive exploration from an action the organization is not ready to commit.
Place the checkpoint where the consequences change. An experiment can move quickly while publication or deployment remains a separate decision.
The cage makes the promise more credible
The agent is not offended by the cage. That is one advantage it has over the colleague who keeps requesting administrator access.