AI agents need an execution boundary.
An agent’s work can extend from a single instruction into files, commands, connections, and child processes. Its execution environment needs a clearly defined scope for that work.
Give the task a defined place to run.
An AI agent can turn a request into a sequence of actions. It may start a shell, execute a script, modify a workspace, or contact a service. Each action uses resources and permissions supplied by its environment.
That makes the execution environment part of the product’s security model. A task should have an explicit workspace, a defined set of accessible resources, and limits appropriate to its purpose. Those permissions need to apply throughout the work, including when the agent starts another process.
Bantay is being developed as an execution layer for AI agents. Through one CLI, an operator selects a policy and starts a managed run. Bantay prepares an isolated environment and establishes its restrictions before the workload begins.
Start with the boundary in place.
The order matters. An agent that has already started may have opened files, established connections, or launched children. Attaching an observer later cannot establish what happened before it arrived or undo access already obtained.
An enforced Bantay run therefore begins with a managed launch. The environment and required permissions are prepared before workload execution. If the required boundary cannot be established, the workload should not start as an enforced run.
Policy expresses the resources the task is permitted to use: file access, network destinations or disabled networking, and resource limits. A task that edits code offline might receive a writable workspace and access to prepared runtime tools, with networking disabled.
The installed policy determines whether a covered operation is permitted. Normal permission changes take effect in a new run. This makes the policy associated with a run a stable reference when reviewing its activity.
A child process is still part of the task.
An agent can start a shell, which starts a script, which starts another process. The original agent process is only the beginning of that execution history.
Bantay’s managed-run design keeps descendants within the established restrictions. A newly created child inherits the boundary; its permissions do not depend on an operator noticing it in a dashboard. A run can remain active while descendants continue working after the original process exits.
The evidence should preserve those relationships. If a child attempts a protected read, an operator should be able to follow the recorded action back through its process ancestry and identify the run it belongs to.
This scope has a limit. A remote service contacted by a workload is a separate system with its own authority. A local execution boundary does not establish what that service can do internally.
Keep attempts, decisions, and outcomes distinct.
An attempted operation is not proof that it completed. A policy decision permitting an operation is not proof that the requested resource was available. A recorded failure does not always identify the exact rule or control responsible.
Useful evidence preserves these distinctions. It records what was observed, where a decision is known, and whether an outcome was captured. It connects activity to process history without inventing a missing relationship or explanation.
Evidence collection also has limits. A record may be incomplete because activity was not captured or a component was interrupted. Those gaps need to remain visible. An unknown result should stay unknown.
Enforcement and evidence have separate responsibilities in Bantay’s design. The installed permissions govern covered operations. The evidence helps an operator investigate what happened. A missing console event does not grant permission.
An explanation should lead back to evidence.
The proposed Bantay console brings recorded activity, policy context, and execution traces into one investigation. An operator can begin with a denied operation, inspect the responsible process, and follow its ancestry.
The AI companion preview extends that experience with explanations linked to the source event, policy context, and process trace. It can illustrate where to look next while keeping observed facts and suggested investigation steps distinct.
A denial alone does not establish malicious intent. Missing activity does not establish that nothing happened. The operator needs access to the underlying records and their limits to assess an explanation.
Bantay is in development. The website’s managed-run walkthrough, console, and AI companion use illustrative examples. They describe the intended experience; implementation verification, supported environments, and agent compatibility will determine the released scope.