/why/thesis
Agents changed the security boundary
For the last decade, enterprise security invested in the point where a human touches a system: the browser tab, the SaaS session, the rendered page. Secure web gateways, CASBs, the secure enterprise browser — all instrument the human interface.
That control point goes blind the moment an agent does the work headlessly — calling APIs directly, installing packages, writing to production systems, without ever rendering a page for a human to be watched on.
The durable place to enforce policy, capture audit evidence, and prove isolation is no longer the interface a human clicks. It is the execution boundary the agent's work crosses — the layer where shell commands, code, file writes, package installs, network calls, and secret access actually happen.
NeuronEdge Enclave is a bet that the agent execution boundary becomes the enterprise control point for agentic work.
/why/control-point
Where the control point moved
then / human-driven
now / agent-driven
The agent doesn't use a browser. It calls APIs, runs code, installs packages. The old control point (watch the human) can't see any of it. The new control point (the execution boundary) sees everything.
/why/options
Why existing options fall short
Containers (Docker, Kubernetes, gVisor)
All three share a kernel with the host. A guest kernel exploit chain — including the long tail of historical container escapes — bypasses the boundary. For agent-generated code that may originate from prompt injection, supply-chain compromise, or adversarial training data, a hardware-rooted boundary is qualitatively different.
runc (CVE-2019-5736), containerd (CVE-2022-23651), the Docker socket escape — each is a container-escape class that a microVM makes irrelevant.
Managed sandboxes (E2B, Modal, Cloudflare Sandbox)
For non-sensitive workloads this is fine. For regulated enterprises it's a non-starter: data residency violations, DPA mismatches, attestation gaps, and subpoena exposure at the vendor.
The vendor holds your data and can be compelled to produce it — and can't prove the execution environment was untampered.
"No boundary" — laptop or shared CI runner
Most agent deployments today run code with no isolation boundary. A compromised agent — malicious tool call, poisoned dependency, prompt injection — has the full access of the machine it runs on.
The blast radius of a compromised agent is the entire machine.
/why/answer
How Enclave meets each requirement
A self-hosted Firecracker microVM runtime where every workspace gets its own kernel — plus an optional confidential mode where the workspace runs inside an encrypted, hardware-attested CVM that even the cloud operator can't read.
| Requirement | How Enclave meets it |
|---|---|
| Separate-kernel isolation | Firecracker microVM per workspace (the same VMM that powers AWS Lambda) |
| Customer-owned infrastructure | Single-binary self-host install; runs in your VPC or on-prem |
| Hardware-rooted attestation | AMD SEV-SNP, exercised on Azure DCasv5; key release gated on firmware evidence. The confidential profile stays preview until the signed release candidate passes its artifact gate. |
| Operator-excluded confidentiality | SEV-SNP memory encryption — the cloud provider sees ciphertext, not plaintext (within the preview profile above) |
| Audit-grade governance | Signed event stream; every command, network call, and snapshot is an independently-verifiable audit event |
| Agent-native primitives | Create / exec / write / read / snapshot / fork / destroy — designed for agent planning loops, not human dev environments |
| Open source | Apache-2.0. The runtime, SDKs, and deploy artifacts are open forever. |
/why/scope
What it doesn't solve
NeuronEdge Enclave doesn't solve agent alignment (whether the agent does the right thing — that's the model and prompt's job). It solves execution-boundary safety: a jailbroken agent contained by Enclave cannot escape the microVM/CVM boundary by design; it can still produce wrong outputs.
The confidential tier attests the host CVM launch, not the agent's guest code (guest-code measurement is a tracked follow-on). The isolation within the CVM is OpenShell's shared-kernel sandbox (Landlock/seccomp/netns), not a separate per-workspace hardware boundary.
We publish the full threat model because the honest ceiling is the product.
The execution boundary is the new control point.
Own it. Self-host it. Attest it.