MVM is an execution substrate for software that should not inherit the host’s authority.
The immediate use case is AI agents: workloads that can read data, invoke tools, generate code, launch browsers, communicate with services, and potentially create more workloads. The useful behavior is dynamic. The security contract cannot be.
The problem
Most agent runtimes secure the application while leaving the process with broad machine access. A tool registry may limit the functions exposed by the orchestrator, but the workload can still inherit network access, credentials, writable filesystems, or an operational environment much larger than the task requires.
Once a controller can launch workers, the problem compounds. A benign retry loop can exhaust the host. A compromised planner can amplify its authority across a swarm. A single unbounded channel can turn logging or messaging into a denial-of-service path.
The direction
MVM treats every execution as a capability lease.
A workload receives a content-addressed machine definition, an explicit resource budget, narrow input and output channels, and only the service access granted by policy. The guest has no ambient network. External communication crosses a host-controlled transport and policy gateway where identity, destination, method, rate, and data volume can be enforced.
The same model extends to workflows. A controller may request child microVMs only within a delegated budget and capability envelope. Children cannot receive authority the parent does not possess.
Core design goals
- Hard isolation: a guest kernel boundary for general-purpose workloads
- No ambient authority: no direct host filesystem, host secrets, or unrestricted network
- Mediated I/O: narrow vsock or Unix-domain communication owned by the host
- Bounded everything: CPU, memory, storage, time, message size, queue depth, and descendants
- Attenuating delegation: child capabilities are provable subsets of the parent lease
- Durable evidence: causal, structured audit events survive after ephemeral state is destroyed
- Fast secure path: isolation should be cheap enough to use for small units of work
Why it matters
The aim is not to make an agent harmless. A harmless agent is often not useful.
The aim is to make power legible: the operator can see what the workload may do, the runtime can enforce it, and the evidence can show what happened.