Isolation. Security. Scale: Without these three things, Agents cannot be

The Cloud Native Computing Foundation outlined an operational architecture uniting kagent v1.0 and Agent Substrate to solve the core infrastructure challenges of deploying AI agents in production environments, according to CNCF Blog's report. Authored by CNCF Ambassador Michael Levan on October 26, 2026, the guidance addresses the operational vulnerabilities inherent in running autonomous agentic workloads inside conventional container boundaries. Standard Linux containers leave ingress and egress traffic open without strict policy enforcement, creating a flat sandboxing layer where untrusted model outputs or malicious tool calls can compromise host nodes. By pairing kagent as a declarative runtime with Agent Substrate as an underlying isolation platform, teams can run declarative and bring-your-own agents built on frameworks like langgraph or ADK within strict software- and hardware-level isolation perimeters.

This operational analysis breaks down the technical mechanics of container isolation limits, control-plane coordination, and Kubernetes resource allocation for platform engineers and system architects. Running agent harnesses like Codex or Claude Code demands predictable blast-radius confinement, persistent execution checkpoints, and automated routing boundaries across multi-tenant clusters. Rather than relying entirely on manual networking tweaks or direct programmatic API calls via curl to raw execution actors, the integration introduces declarative Kubernetes Custom Resource Definitions alongside a graphical interface for continuous agent management. The following sections walk through the mechanics of worker pools, system-call interception kernels, microVM boundaries, and ephemeral actor session scaling.

Isolation. Security. Scale: what actually changed

Traditional containerization engines spin up containers that share a flat host kernel where sandboxing provides minimal isolation against malicious activity. Under that default setup, network ingress and egress remain unrestricted, allowing workloads to transmit arbitrary packets across internal subnets unless operators maintain complex manual routing rules and network policies. This architecture fails to provide enforceable policy constraints or security barriers against untrusted agent code attempting host escapes. Without isolated boundaries, autonomous agents handling sensitive credentials, tool calls, and model outputs can expose the broader infrastructure if a single harness is compromised.

The deployment model introduced with kagent v1.0 and Agent Substrate fundamentally shifts this execution pattern by enforcing hardware- and software-level isolation before network traffic reaches its destination. All agents execute within dedicated Worker Pods managed through Agent Substrate's ateapi control plane. Software-level isolation isolates user-space operations using gVisor and its dedicated Sentry application kernel to intercept and evaluate system calls. For workloads requiring physical hardware separation, microVM guest virtual machines run directly on physical CPU cores via hardware virtualization extensions, ensuring that untrusted execution cannot penetrate the underlying host environment.

Isolation. Security. Scale: how it works

Platform teams implement this architecture directly on Kubernetes clusters, including local testing setups using Kind or Minikube, by installing Agent Substrate and kagent through Helm. The configuration requires configuring the kubectl-ate command-line interface to interact directly with Agent Substrate's control plane. Deploying the kagent Helm chart with the substrateWorkerPool.create=true setting automatically provisions a default WorkerPool consisting of two Worker Pods. This pool serves as the underlying compute fabric that provisions ephemeral execution instances across cluster nodes without requiring manual node provisioning.

Workloads are declared using the kagent.dev/v1alpha3 API group across two distinct Custom Resource Definitions: the Harness and the AgentTemplate. The Harness resource configures the Actor runtime adapter, workload container image path, worker pool reference, allowed template selectors, and snapshot policies targeting storage locations such as Google Cloud Storage buckets. The AgentTemplate resource defines golden-image configurations, setting system prompts, model configs, and reusable metadata. Once declared via kubectl or created through the purple buttons in the kagent web interface, the ateapi control plane coordinates the underlying Actors.

Isolation. Security. Scale: why it matters now

Agent sandboxing has moved beyond traditional runtime concerns because autonomous systems retain persistent states, external credentials, and broad tool-execution permissions. In multi-tenant environments, routing traffic across multiple agents requires strict multiplexing boundaries to prevent cross-tenant data leakage and lateral network movement. Furthermore, long-running agent workflows require continuous snapshotting so interrupted operations can restore their exact state and resume tasks seamlessly. When agents execute external tools or write automated scripts, infrastructure teams must guarantee that any failure or exploit is trapped within a zero-trust perimeter.

The combination of kagent and Agent Substrate eliminates the need for teams to build custom infrastructure just to mediate calls between clients and isolated agent runtimes. Without kagent, accessing Agent Substrate requires writing custom programmatic calls and raw curl scripts to communicate with the ateapi control plane. Providing both a declarative Kubernetes-native API and an interactive management interface brings agent sandbox governance into existing enterprise DevOps workflows. The platform ensures that AI Gateway policies enforce guardrails as traffic flows into isolated actor environments, giving enterprises the policy enforcement necessary to trust autonomous workflows.

Isolation. Security. Scale: who is affected

This platform shift directly impacts platform engineers, site reliability teams, and enterprise security architects tasked with deploying agentic frameworks into production Kubernetes clusters. Engineering teams relying on autonomous coding harnesses such as Claude Code or Codex, as well as developers building custom agent logic using frameworks like langgraph or ADK, must adhere to strict sandboxing boundaries. Rather than granting agents unmonitored host-level access or unsegmented container spaces, administrators can standardize deployment manifests using shared AgentTemplate specifications that ensure unified system prompts and model definitions across development teams.

Organizations operating multi-tenant environments benefit from deterministic resource allocation and centralized audit controls across every active agent harness. By establishing clear boundaries around tool execution, model credentials, and network pathways, security teams can permit broad agent experimentation without exposing internal cluster networks. Developers retain the flexibility to bring their own custom agent container images while operations teams enforce standard snapshotting policies, worker pool sizes, and namespace limits declaratively through standard Kubernetes manifests.

Isolation. Security. Scale: what to watch

The operational metric to monitor during active deployments is dynamic actor lifecycle scaling inside the Substrate dashboard interface. When no active user sessions exist, the Substrate panel displays an idle state of 0/8 running Actors, confirming that dormant workers do not consume unnecessary compute resources. When a user opens an agent interface, such as the assistant template, and submits an initial prompt, the ateapi control plane provisions a new Actor, raising the dashboard allocation count to 0/9 Actors.

System administrators must monitor this allocation pattern as concurrent sessions expand across the cluster. Opening a second distinct user session spins up another dedicated Actor, advancing the total to 0/10 Actors, while continued interactions inside an existing conversation reuse the active instance without creating additional overhead. Because an Actor terminates immediately once its session completes, operations teams must verify snapshotting policies to ensure execution states persist reliably to designated bucket storage across dynamic spin-up and teardown cycles.