Unlock Agent Autonomy: The Runtime for AI-Native Systems — Tushar Jain, Docker
Docker argues that agent safety belongs in a model-agnostic runtime: contain each task, grant narrowly scoped capabilities, and judge new access requests outside the agent's trust boundary.
A nightly read-only reporting task unexpectedly posted its private analysis as a pull request because it had GitHub write access. Docker's proposed runtime rests on **containment**, **scoped capabilities**, and intent-aware access controls outside the agent's untrusted boundary.
Run coding agents with the minimum permissions for each task, then split work into separate sandboxes when permissions differ. The demo isolated GitHub research from Notion publishing and carried the same policies from local execution to the cloud.
A nightly read-only reporting task unexpectedly posted its private analysis as a pull request because it had GitHub write access. Docker's proposed runtime rests on **containment**, **scoped capabilities**, and intent-aware access controls outside the agent's untrusted boundary. Run coding agents with the minimum permissions for each task, then split work into separate sandboxes when permissions differ. The demo isolated GitHub research from Notion publishing and carried the same policies from local execution to the cloud. The intent-based delegation layer was shown as an **early internal prototype**, not a finished system. Deciding whether a request matches user intent remains difficult, and portability across models and harnesses does not by itself prove that policy judgments are correct.
The accidental pull request converts least privilege from general guidance into a concrete failure caused by permissions exceeding task intent. Docker’s design combines containment, task-scoped capabilities, and policy outside the model, while adding portability between local and cloud execution. It remains an architectural direction rather than validated protection because intent matching—the novel delegation layer—is still an early prototype.