Field Note #2: Setting up your agent environment
There are three decisions to make before you run anything.
Card 1 covered the parts of an agent. Setup means wiring them together so it can run. Most people skip the first decision. It matters most for safety.
01 ISOLATE: where it runs
02 SCOPE: who it runs as
03 BUILD: what it is made of
01 · WHERE IT RUNS · ISOLATE IT
An agent can write its own code and run it before you read it. Not every agent can do this. The most important decision is where you let it run. The less you trust that code, the more you wall it off from your real computer.
microVM (strongest)
What it is: its own separate computer to run inside, using Firecracker or Kata.
Use it for: code the agent writes and runs before you can read it.
gVisor (middle)
What it is: sits between the agent and your computer and screens each request before it goes through. More separation than a container, less than a full computer.
Use it for: when a full separate computer is more than you need.
plain container (weak)
What it is: partly separates the agent. It shares your computer’s core system, so the wall is thin.
Use it for: code you already trust. Too weak for code the agent writes itself.
no sandbox (none)
What it is: runs directly on your computer, with nothing between its code and your files.
Use it for: avoid for code the agent writes or any code you haven’t reviewed.
Start with no internet access. Add only the sites or services the task needs.
What this setup limits:
- Isolate: limits where the agent’s code can run and what it can touch.
- – Scope: limits the login it can use and what that login can do.
- – Build lean: fewer tools means fewer ways in.
02 · WHO IT RUNS AS · SCOPE IT
Give the agent its own login, with only the access the task needs. Don’t run it under your personal account.
Like a badge that opens one room, not every door.
Give it:
- its own login, not yours
- – access to one system to start
- – read access before write
- – a login that expires
Deny it:
- your personal login
- – admin rights that never expire
- – write access to live systems
- – open internet access
03 · WHAT IT IS MADE OF · BUILD IT LEAN
Pick one model and one framework. Connect only the tools the task needs. Each extra tool is another way in.
- Local model (Gemma, Qwen): runs on your own hardware, so it needs strong memory and a graphics card. The model itself doesn’t send your data out. Tools it uses still can.
- – Hosted model (Claude, ChatGPT): runs on their computers, so you need only an API key. Your data leaves your network.
- – One framework, the fewest tools. Start read-only. Add changes later.
04 · COMMON SETUP MISTAKES
- The agent logs in as you, instead of an account made for it.
- – A plain container runs code the agent wrote itself.
- – The agent gets access to live systems on day one.
- – Too many tools are connected at once.
- – Passwords or keys are pasted into the prompt.
- – The login is set with no expiry date.
05 · SETUP CHECKLIST
✓ A sandbox strong enough for code the agent writes.
✓ Its own login, limited to the task.
✓ Read-only access and a login that expires.
✓ One model, one framework.
✓ Tools added one at a time.
Next: Card 3 covers running your first agent.
Sources: NIST SP 800-190, OWASP Top 10 for Agentic Applications for 2026, Firecracker / gVisor / Kata docs.
Save for reference.
#AgenticAI #AIGovernance #CISO #AISecurity
First comment (posted after publishing): Primary source: OWASP Top 10 for Agentic Applications for 2026 (OWASP GenAI Security Project, Dec 2025). https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/