Keeping AI agents safe: sandboxes, scoped credentials, and an audit trail

2026-10-11 · updated 2026-10-29 · Avi Agola, The Seattle Compute Company

Giving an agent real accounts is where the value is, and where the risk is. These are the controls we think any team should expect before letting agents act on their behalf.

1. Isolate each agent

Run every agent in its own sandbox. One agent's files, browser profile, and processes should be invisible to another. If one is compromised or confused, the damage stays inside its box.

2. Least-privilege, revocable credentials

Each agent should hold a scoped, expiring token that names exactly what it may do — for example send mail and read its own inbox — and nothing more. Real provider credentials should stay on the server in an encrypted vault; the agent proves who it is and the broker acts for it. Revoking an agent should be one action.

3. Verify who is asking

An agent should know whether a request came from its owner, a teammate, or an outsider, based on server-verified identity rather than what a message claims. Unverified inbound mail should never be treated as an instruction.

4. Keep a human in the loop where it counts

Some steps need a person: a captcha, a code sent to the owner's phone, a payment. The agent should ask clearly and offer a way to take over its live screen, then continue. It should also clear second-factor prompts it owns itself rather than interrupt you for them.

5. Make it stoppable

Provide a stop command that reaches running jobs, queued work, and in-flight browser actions — not just the next message.

6. Log everything

Record what each agent did, with which credential, when. An audit ledger turns "what happened?" from guesswork into a lookup.

Governance: who owns the agent, and who answers for it

The controls above are technical. Governance is the part that decides who is responsible. If you are building an AI agent governance policy, it should be able to answer five questions about every agent:

1. Who is it? Each agent is a known identity, or a clearly marked delegation of a person's account.
2. Who owns it? One named person answers for what it does.
3. What can it reach? Access is scoped to the job and revocable.
4. What did it do? Every action is traced to the agent that took it and the account it used. This is what AI agent accountability means in practice.
5. Who can stop it? Someone can halt it at any time and take over its screen.

The failure case is an agent running under an employee's own login, where the log cannot tell the two apart. We wrote about that in shadow AI agents, including what surveys from SailPoint and the Cloud Security Alliance found.

How Smith approaches this

Smith combines per-agent sandboxes, scoped tokens, an encrypted credential vault, sender verification, human takeover, stop controls, and a ledger. Read the terms and privacy policy, or create an office.