Secure · Secure Agent Runtime
Available nowRun AI agents inside clear boundaries
Halo runs each agent as a sandboxed, non-root workload with default-deny network egress and signed configuration. File, network, process, credential, and model boundaries are explicit, and operators can quarantine an agent and release it later.
- network egress for agent workloads
- Default-deny
- workload execution
- Non-root
- configuration verified at startup
- Signed
Why it matters
Agents act, so where they run matters
An AI agent can call tools, read files, and reach the network on its own. If the environment around it is open, one bad instruction or one compromised tool can reach far beyond the task.
- 01
Agents with broad network access can send data to destinations nobody reviewed.
- 02
Configuration that can change after approval makes it hard to say what was actually running.
- 03
When an agent misbehaves, operators need a way to stop it and keep the evidence.
Capabilities
Boundaries built into the runtime
Each boundary is explicit, so reviewers can describe what an agent can touch and operators can contain it when something looks wrong.
Sandboxed execution
Each agent runs as its own isolated workload with explicit file, network, process, credential, and model boundaries.
Non-root workloads
Agent workloads run as a non-root user with no privilege escalation, which limits what a compromised process can do on its host.
Default-deny egress
Outbound traffic is blocked by default. Only traffic to Halo and approved destinations is allowed, so an agent cannot reach arbitrary endpoints.
Signed configuration
The control plane signs each runtime configuration, and the runtime verifies the signature at startup. A configuration that fails verification does not start.
Gateway-mediated actions
Model and tool calls go through Halo gateways, which apply identity, policy, approvals, budgets, and evidence to agent traffic.
Quarantine and release
Operators can quarantine an agent to suspend its access pending review, then release it when the issue is resolved. Both actions appear in the audit log.
How it works
From deploy to contained execution
Each step leaves a record, so reviewers can follow an agent from its configuration to its actions.
- 1
Compile and sign
At deploy time, the control plane compiles the agent's configuration into a signed envelope that holds its instructions, tools, policy, and credential references.
- 2
Start in isolation
Halo provisions an isolated workload for the agent. The runtime verifies the signature, registers with the control plane, and begins sending heartbeats.
- 3
Route calls through gateways
Model and tool calls pass through Halo gateways that check identity and policy, ask for approval when a rule requires it, and record evidence.
- 4
Watch and contain
Operators monitor health and activity, and can quarantine an agent that misbehaves, then release it after review.
Operator control
A stop control that operators hold
Quarantine suspends an agent's access so operators can investigate, and release returns it to service once the cause is resolved. A quarantined agent shows up as a security finding, and both actions are recorded as audit events.
- Quarantine suspends access pending review
- Release returns the agent to active deployment
- Quarantine and release appear in the audit log
- Heartbeats surface runtimes that stop responding
FAQ
Questions, answered
Each agent runs as its own sandboxed workload with explicit file, network, process, credential, and model boundaries. The workload runs as a non-root user, and outbound network traffic is denied by default except to Halo and approved destinations.
Default-deny egress blocks outbound network traffic unless a rule allows it. For agents, that means the workload can reach Halo and approved endpoints. A tool call to a destination outside that list fails at the network layer even when the agent attempts it.
The control plane signs each runtime configuration, and the runtime verifies that signature at startup. If verification fails, the workload does not start. Each deploy also creates a numbered revision, so a run traces back to the configuration that was active.
Quarantine suspends the agent's access immediately so operators can investigate, and the agent does not accept new runs until an operator releases it. Quarantine and release are recorded as audit events.
Provider and app credentials stay bound at the Halo gateways through credential brokering. Agents receive scoped capabilities and never see raw keys. Credential values are write-only in Halo, so they cannot be read back after you save them.
Put a halo around the AI your business runs.
See discovery, runtime policy, approvals, and evidence working together on your own use cases.