Use cases · 01

Arbitrary code execution, on purpose.

A coding agent clones a repository, installs whatever the lockfile says, and runs whatever the test suite runs. That is remote code execution as a feature, and it is the most common first workload we govern.

01 / the premise

Your CI runner has more security review than the agent on your laptop.

CI is locked down because everyone accepts that build scripts are untrusted. Then a coding agent runs the same scripts on a developer machine that holds a production AWS profile, an npm token, and an SSH key with write access to forty repositories.

Nothing about the agent is malicious. It installs a package that runs a postinstall script, and that script reads the environment. The agent never decided to do anything wrong.

02 / what the agent does

1
Clone
Pull the repository and any private submodules.
2
Install
Run the package manager, which runs third-party scripts.
3
Iterate
Edit, run tests, read failures, edit again.
4
Propose
Push a branch and open a pull request.

03 / what goes wrong

The failures that keep this in pilot.

Failure	How it happens	What stops it
Credential theft	A postinstall script or a compromised dependency reads environment variables and posts them out.	No credentials in the sandbox. Git and registry access are proxied through the gateway, which holds the tokens.
Dependency confusion	A typosquatted or substituted mirror serves a malicious package.	Registry allowlist with pinned resolution. A mirror swap in .npmrc fails closed instead of silently succeeding.
Force-push over main	The agent resolves a conflict by overwriting the branch.	Git operations are tools with policy. Force-push and protected-branch writes escalate to a human.
Exfiltration via test	A test sends source or data to an external endpoint, which looks exactly like a normal network call.	Default-deny egress. The test still runs; the call to an unlisted host never leaves.
Runaway spend	A retry loop reinstalls, rebuilds, and re-queries a paid API for hours.	Hard budgets on wall-clock, tool calls, and spend, enforced by the kernel rather than the loop.

04 / the boundary

What you actually write down.

# velone.policy.yaml  ·  coding agent
version: 2
session: repo-agent
ring: 2

egress:
  default: deny
  allow:
    - github.com
    - registry.npmjs.org
    - pypi.org
    - proxy.golang.org

tools:
  shell.exec:
    allow: true
    deny_args:
      - "curl * | sh"
      - "rm -rf /"
      - "git push --force*"
  files.write:
    allow: true
    paths: ["/workspace/**"]          # not ~/.ssh, not /etc
  git.push:
    allow: true
    deny_branches: ["main", "release/*"]
  git.force_push:
    escalate: true
    approvers: ["platform-oncall"]

budget:
  wall_clock: 2h
  tool_calls: 1500
  spend_usd: 10

Note what is missing: no AWS credentials, no production database URL, no npm publish token. The agent cannot leak what it was never given.

05 / what changes

Developer machines: Stop being the execution environment. The agent runs in a microVM whether it was started from a laptop or from CI.
Secrets: Git and registry tokens live in the control plane. A compromised dependency has nothing to steal.
Review: The pull request arrives with an evidence link: every command the agent ran to produce it.
Parallelism: Fork a sandbox to try two fixes from identical state, then keep the branch that passed.
Incident response: When a bad change ships, replay shows the exact sequence rather than a reconstructed guess.

06 / questions

Will this slow the agent down?

Sandbox start is under 200ms from a warm pool and policy decisions are around a millisecond. Against npm install, neither is measurable.

Our agent needs to run the real database in tests.

Give the session a scoped connection through the gateway to an ephemeral database, not your production instance. The gateway holds the credential and the policy caps the statements.

What about Claude Code and Codex specifically?

Both have adapters. Codex runs inside a Velone ring with one command; the Claude Agent SDK swaps its bash and file tools for governed equivalents and subagents get child sessions.

Can the agent still open a PR?

Yes. Pushing a feature branch is allowed; pushing to main or force-pushing escalates. The normal path stays fast and the dangerous path stops.

keep reading

SandboxesThe isolation the agent runs inside.AdaptersWiring Claude Code, Codex, or your own loop.Data engineeringWhen the agent writes SQL instead of code.

Ring 0

Point a coding agent at a real repository.

Run it once inside a ring and read the evidence. The denials are usually the interesting part.

Request access