Mxc: Microsoft Execution Containers version 1.0.0

Policy-Driven Containment for AI Agents

While AI agents are driving massive leaps in productivity, their capacity to interact with networks, applications, and local files introduces significant security vulnerabilities. Historically, organizations felt trapped between two suboptimal choices:

• Grant agents total, unrestricted access and pray for the best.
• Block agents entirely and sacrifice all productivity gains.

To resolve this dilemma, Microsoft is introducing new Windows platform capabilities designed to manage agents with precision. The strategy focuses on two primary pillars:

1. Containment: Strictly limiting the actions an agent can perform and the data it can reach.
2. Manageability: Providing administrators with the necessary tools for oversight, governance, and activity monitoring.

Microsoft Execution Containers (MXC), now generally available, serves as the foundational containment layer. By allowing developers and IT admins to specify exactly which network destinations and files an agent may utilize, MXC enforces these policies at runtime using specialized containers.

The Roadmap for Agent Governance

Beyond the initial release of MXC, Microsoft is expanding the ecosystem:

• Microsoft Entra Integration: Soon, Windows will use Entra to differentiate between a human user's actions and an agent's actions.
• Microsoft Agent 365 Extension: Local on-device agents will soon be manageable via Agent 365 controls, allowing IT teams to monitor activity and apply policies centrally.

---

The Necessity of a Managed Execution Boundary

A fundamental security principle is that an agent cannot be its own security authority. To be safe, an agent must operate within a perimeter defined by an external entity (the developer or the organization) and enforced by a system independent of the agent itself.

Scenario: The Coding Agent Imagine an agent tasked with updating a codebase. It requires:

• Read/Write access $\rightarrow$ Website repository.
• Execution access $\rightarrow$ Build and test tools.
• Read-only access $\rightarrow$ Production server configurations.

Without a managed boundary, the agent might determine that the fastest way to solve a problem is to modify the production server configuration directly. While this may seem logical to the AI, it exceeds the intended authority and could crash the live site.

By implementing containment, we create a mathematical boundary where: $\text{Effective Permissions} = \text{Agent Request} \cap \text{MXC Policy}$

If the agent attempts an unauthorized write operation to the server config, the containment environment blocks it, regardless of what the model, the generated code, or the plugin suggests.

---

Technical Architecture of MXC

MXC acts as a policy-driven execution layer specifically for dynamically generated workloads or untrusted code. It can be used to isolate:

• Model-generated outputs
• Third-party plugins and tools
• The agent harness
• The entire agent entity

Simplified Developer Experience

MXC abstracts the complexity of platform-specific isolation. Developers don't need to write different security logic for every OS; instead, they use a unified JSON configuration schema and a multi-language SDK.

{
  "container_policy": {
    "network": {
      "allowed_destinations": ["api.github.com", "internal.dev.local"]
    },
    "filesystem": {
      "read_write": ["/home/user/repo"],
      "read_only": ["/etc/config"]
    }
  }
}

Cross-Platform Deployment

MXC maps these high-level requests to the specific backends of the host OS:

Furthermore, with the general availability of Windows 365 support, developers can now deploy these agents on Cloud PCs, ensuring that agent execution remains isolated from the primary workspace.

---

Selecting the Appropriate Containment Level

Not every task requires the same level of rigor. A low-latency coding assistant has different needs than an agent processing highly sensitive financial data.

Containment Options Comparison