Workspaces: How We Built Sandbox Infrastructure for Autonomous Agents | NeoSigma

Legal

Contact<br>San Francisco, CAfounders@neosigma.ai

Closing the feedback loop in production.

Company

Legal

Contact<br>San Francisco, CAfounders@neosigma.ai

© 2026 NeoSigma Inc.. All rights reserved.

←Home

10 min read·July 17, 2026<br>Workspaces: How We Built Sandbox Infrastructure for Autonomous Agents<br>How we built the workspaces where AI agents execute, explore, and learn from experience. A deep dive into the architecture behind realistic, reproducible, fast, and isolated agent execution.<br>Aditya BilawarGauri GuptaRitvik Kapila<br>ShareLinkedIn

In this article

Share<br>Share on XShare on LinkedIn

Read time<br>10 min read

In this article7 sections↓<br>An agent is only as capable as the environment it can safely act in.

To work autonomously, agents need a way to verify their own work. The agent can have a rich action space and a perfect reward signal, but without a real environment to execute in, those capabilities remain largely theoretical. As models become more capable, they're trusted with increasingly consequential work: modifying databases, running arbitrary code, deploying infrastructure, and interacting with production APIs. With a full runtime workspace, agents can verify their own work and iterate until success.<br>The challenge is to build a workspace that is indistinguishable from a developer's local environment while safely isolating the consequences of everything an agent does. A sandbox provides an isolated execution environment where an agent can safely run code, interact with services, and recover from failure. A well-designed sandbox gives an agent a real playground while ensuring every action remains isolated, reproducible, and disposable.<br>A great execution environment should have the following core properties:<br>1.Control plane: keeping execution ready with minimum latency<br>Provisioning must feel almost instantaneous, making the experience responsive enough to become part of a developer's everyday workflow.

2.Execution plane: a real machine, not a shell<br>The environment should feel indistinguishable from a developer's local setup. Agents need a real filesystem, Docker, customer repositories, databases, development services, networking, tools, and the same setup scripts they would execute in a real development environment.

3.Security and Network plane: isolating capability without restricting it<br>Agents need the freedom to take meaningful actions, but every action should be isolated behind strong security boundaries. The goal is not to restrict what the agent can do inside its workspace, it's to ensure those actions execute safely within well-defined security, access, and network controls.

4.Data plane: deterministic state at production scale<br>Every execution should begin from a known state, and every action should be recoverable. Identical inputs should produce identical environments, making failures debuggable, evaluations repeatable, and successful trajectories reusable.

Every design decision ultimately optimizes for the Pareto frontier across these core principles.<br>In this post, we walk through the core infrastructure powering the workspaces where agents execute, explore, and learn from experience. We talk about how we provision the workspace with the same capabilities as a real environment, including a real filesystem, Docker, networking, representative data, and production tooling, while ensuring every run remains isolated, reproducible, and disposable.<br>01Overview

THE ANATOMY OF A WORKSPACE

attachkeeps fullREQUESTCONTROL PLANESchedulerWARM POOLDaytonaVersioned snapshotsWORKSPACEinbound allowlistEXECUTION PLANEFilesystemCloned reposMCP serversDOCKERappdbcachenested servicesDATA PLANEPostgresRedisOLAPSECURITY & NETWORKCredential proxyattaches real key, never in the boxExternal APIsegressExecution tracepersisted outside the boundary

Expand

The control plane minimizes latency by ensuring execution environments are ready before they're needed. The execution plane provides the fidelity of a real developer workstation rather than a constrained runtime. The security plane enforces strong isolation without limiting what an agent is capable of doing. Finally, the data plane guarantees every sandbox begins from an identical, reproducible state.

02Control plane: keeping execution ready with minimum latency

Agents are interactive systems, and every second spent preparing an execution environment is a second the user spends waiting. Booting a microVM, provisioning storage, cloning repositories, initializing services, loading tools, and performing health checks can easily dominate the critical path of a request. If every interaction requires creating a sandbox from scratch, even the most capable model quickly feels sluggish.<br>The obvious solution is to avoid creating sandboxes on demand.<br>The control plane orchestrates the lifecycle of execution environments, ensuring the right sandbox is provisioned, initialized, and...