This is a companion map to my Building ShrekOS series. If you have read Part 2 , you have the argument already. This post is the picture: how an untrusted workload gets to do real work while reaching almost nothing. The whole thing runs on one idea. An agent, or any untrusted job, runs inside a Bench: a disposable box that starts with no files and no network, and is handed capabilities one at a time, narrowly, and revocably. Four rules Deny by default. A Bench starts wit...