Board: the agent sandbox

The goal is to show how a coding agent can run with minimal supervision when the worst case is that it leaks almost nothing.

Whiteboard outcome

When you’re done, the board shows a VM with an agent (Shelley, claude, codex or pi) inside, the integration hostnames it calls, the secrets kept outside the VM, an egress wall, and the human reviewing the work through the private proxy.

Before you draw: three questions

1. Which agent, and which model provider?
2. Which systems does it need to touch (GitHub, an internal API, S3)?
3. Does it need the open internet, or only those systems?

Draw it in 8 steps

1. In the middle, draw a large square: “VM: agent-1 (standalone, 4 vCPU)”. Say: “Each agent gets its own VM. It’s metered by the second and deleted when the job is done” (https://exe.dev/docs/standalone-vms).
2. Inside it, draw “Shelley :9999” and “claude / codex / pi”. Say: “The default image ships with these. Shelley is on the web at vm.shelley.exe.xyz” (https://exe.dev/docs/shelley/intro, https://exe.dev/docs/upgrade-codex).
3. On the right, draw three hostnames as clouds: github.int.exe.xyz, llm.int.exe.xyz, myapi.int.exe.xyz. Draw green arrows from the VM to each one. Say: “The agent calls these names” (https://exe.dev/docs/integrations).
4. Above the clouds, draw a locked safe labeled “tokens & keys (server-side)”, with dashed lines to each cloud. Say: “The edge injects the secret. It was never on the VM, so there’s nothing to steal” (https://exe.dev/docs/integrations).
5. Draw a red arrow from the VM to the safe and cross it out. Say: “Even a prompt-injected agent can’t read ***.”
6. Draw a wall to the left of “the internet” labeled egress agent-1 integrations. Say: “Lock outbound traffic to integrations only, if you want that” (https://exe.dev/docs/internet-access).
7. At the bottom left, draw a person with a green arrow to the VM labeled “private HTTPS + share add”. Say: “You review the agent’s app in your browser. Nobody else can see it until you share it” (https://exe.dev/docs/sharing).
8. At the bottom, write the rule: “Secrets live on the network, not on the VM.”

flowchart LR
  H[You, browser] -->|private HTTPS| VM
  subgraph VM[VM agent-1 standalone]
    SH[Shelley :9999]
    AG[claude / codex / pi]
  end
  VM -->|git clone| GH[github.int.exe.xyz]
  VM -->|/v1/...| LLM[llm.int.exe.xyz]
  VM -->|/users| API[myapi.int.exe.xyz]
  K[(Secrets, server-side)] -.inject.-> GH
  K -.inject.-> LLM
  K -.inject.-> API
  VM -.x|egress: integrations only| NET[Open internet]

The script for the commands

ssh exe.dev new --sandbox --name=agent-1 --egress=integrations
ssh exe.dev integrations add github --name repo --repository owner/repo --attach vm:agent-1
ssh exe.dev egress agent-1                        # show the policy
ssh agent-1.exe.xyz 'git clone https://github.int.exe.xyz/owner/repo.git'
ssh exe.dev rm agent-1                            # metering ends

The integrations add github form is copied from https://exe.dev/docs/integrations-github, and the --egress flag from https://exe.dev/docs/internet-access. GitHub integrations need the GitHub app connected first, so set that up before a live demo.

What they’ll ask