If you run an autonomous LLM agent in a container, here is a question worth sitting with: is your network egress policy actually enforced, or is it enforced if you performed a setup ritual you did once, months ago, on one machine?
We shipped enclave 0.8.0 (Apache-2.0, the sandboxed runtime our own agent fleet runs on) around exactly that failure mode. The short version: a safety control with a four-step activation cost is, in practice, off — and "off unless you opt in" reads on a
Mounting your secrets/
directory read-only (`:ro`
) feels like scoping. It isn't. `:ro`
stops
writes; it does nothing about reads. A compromised or prompt-injected agent reads every file it
can see — so "scoped credentials" was only ever true if the directory was scoped, not the mount
mode. 0.8.0 makes SECRETS_DIR
scope the mount and adds SECRETS_SCOPE
so a pod declares what it
actually needs, instead of getting handed the whole vault behind a :ro
flag that reads as safe.
Same theme across the release:
enclave new
--unsafe-network
opts out). It
was never "off by default" — it was off unless you ran a four-step manual ritual, and that
activation cost was the hole. The real network wall is a sidecar owning the agent's netns with a DNS
proxy + nftables default-deny that command-string tricks (U=$host; curl $U
) can't walk around.web_chat
refuses to start on a non-loopback bind with an empty token0.0.0.0
inside the container by necessity, so the only thing between a changed bind and an
unauthenticated control surface into a PERMISSION=dangerous
agent was the Docker publish — and
nothing cross-checked the two..publish-audit-allow
had shipped with no
enforcer — grep found exactly one reference to the file: itself. An allowlist for a control that
doesn't run reads as a working control, which is worse than none. 0.8.0 ships the scanner, in CI,
failing closed if the allow file goes missing.exists()
, not works()
The one I like most is smaller. Our image-capability preflight returned path.exists()
on the API
key file. So through a whole stretch where a pod's key answered 401 on every call, the capability
board cheerfully read image: ok — key present
. The false alarm and the false all-clear were equally
invisible; a resolved blocker stayed quoted as open for days. It now authenticates against the
provider's free key-check endpoint (no generation spend): 200 → works, 401 → present but dead (with the refresh instruction), anything else → inconclusive. "Present" is not "works," and a probe that
can't tell dead from down diagnoses neither.
If you maintain agent infra, audit your health checks for this class: every exists() that stands in for works() is a green light wired to nothing.
enclave exists to run autonomous agents cheaply — model-tier routing, manager→worker delegation,
and measuring token spend instead of guessing at it. Safety and cost are the same discipline: both die
the same way, to a default that looks fine on a dashboard and isn't. The same cost discipline ships as
two standalone tools you can drop into any project, no runtime required:
`npm i -g @wartzar-bee/tokenscope`
— measures the token cost of prompts, files, and diffs so you see what a change costs Full changelog: [enclave 0.8.0](https://github.com/wartzar-bee/enclave/blob/main/CHANGELOG.md#080--2026-08-22).
It's a public alpha we run daily against a live fleet — issues and bridges welcome.