MicroVMs make the most sense to me, as they are the simplest and cleanest abstraction. I personally use VMs with a mounted github repo and found it to be the simplest mental model. I block all network access except for the domains that the agent needs to talk to, and I remove sudo. Since its all scripted, the VM is easy to drop and recreate and I know exactly whats installed on it.
Drop is interesting because it is thinking about the approach differently - basically an extension of the user's existing userspace. This prevents files from being inadvertently deleted by the agent, but it doesn't prevent the agent from uploading files that it shouldn't be.
MicroVMs make the most sense to me, as they are the simplest and cleanest abstraction. I personally use VMs with a mounted github repo and found it to be the simplest mental model. I block all network access except for the domains that the agent needs to talk to, and I remove sudo. Since its all scripted, the VM is easy to drop and recreate and I know exactly whats installed on it.
Drop is interesting because it is thinking about the approach differently - basically an extension of the user's existing userspace. This prevents files from being inadvertently deleted by the agent, but it doesn't prevent the agent from uploading files that it shouldn't be.
[dead]