Safe by Default.
Agentic AI
Workstations.
Run powerful AI coding agents inside a bounded Linux workspace with governed inference, no ambient egress, non-root execution, snapshot recovery, and secret-safe service boundaries.
AI agents are running
with dangerous defaults.
Root containers. Broad internet egress. Package registry access. Mounted workspaces. Credentials exposed to model context. The attack surface is the entire machine.
The VM is sacrificial.
Each agent runs inside a bounded Linux VM. The workspace is sacrificial, snapshot-recoverable, and operator-controlled. State persists only where the operator chooses.
The membrane is sacred.
A governed proxy sits between the agent and the outside world. Every allowed outbound call is logged, filtered, and scored. The boundary is the product.
The operator controls every dial.
Mounts, internet, root access, and provider backends are all off by default. Every capability loosening is explicit, operator-approved, and reflected in the Sentinel score.
Nine layers of
default safety.
Sealed Linux VM Runtime
Each agent runs in a bounded Linux VM with a controlled workspace. The VM can be snapshotted, restored, or destroyed by the operator.
Non-Root Agent Execution
Agents run as unprivileged users. Root is not available unless explicitly granted by the operator.
No Ambient Internet Egress
All outbound traffic is blocked by default. Allowlists are operator-defined and logged.
Governed Model Proxy
All inference calls route through a governed proxy that logs requests, enforces policy, and keeps provider credentials outside the VM.
Bring Your Own Model Backend
Connect any OpenAI-compatible endpoint. Local, cloud, or self-hosted — your inference, your data.
Root-Owned Secrets / Masked Outputs
Secrets remain root-owned and unreadable. Narrow services use credentials and return masked outputs, so raw secrets never enter model context.
Snapshot Rollback
VM state is snapshotted before each agent run. One command restores to a known-good baseline.
Boot Protocol for Agent Orientation
A structured boot sequence orients the agent to its constraints before any task execution begins.
Sentinel Self-Audit Security Score
A 7-point security checklist runs on every boot. Score is visible to the operator in real time.
Every loosening
is explicit.
Users can enable mounts, internet, root, or provider backends when they choose. Every loosening is explicit, logged, and scored.
default state · operator-controlled · logged and scored
Active prototype
development.
The reference architecture has passed Sentinel 7/7 and survived frontier-model red-team testing.
Join the list.
goblinforge.dev · prototype access · no spam