Microsoft makes Execution Containers generally available for OS-enforced agent permissions

In Microsoft's own example, a coding agent can write to its project repository and read deployment settings, and is blocked from changing those settings ^[5]. The rule lives in a policy that lists file paths and network destinations ^[3]. MXC picks a containment backend and enforces the policy at runtime, outside the agent's control ^[4]. A model told to leave deployment settings alone can still be talked out of it. According to RuntimeWire, Microsoft wants Windows to supply the boundary so developers no longer rely on instructions to the model or limits inside the agent application ^[11].

The boundary starts where the agent's application adopts it. The repository's description puts MXC inside the application build ^[15]. The operating system does the enforcing, but only for workloads an application launches through MXC ^[4][15]. In our view, a team running an agent from a product that has not integrated the SDK still depends on that product's own limits ^[15].

A shared policy format does not give every platform the same isolation ^[6][7]. On macOS, the process container is the only backend in the launch materials ^[17]. The Windows session container is the heavier option. It runs under a separate Windows account and isolates the agent's desktop, clipboard, user interface and input from the interactive user's session ^[13]. RuntimeWire describes that as a different level of separation from a lightweight process sandbox, and says developers must choose by workload and the security properties they need ^[14]. The same report also says MXC itself selects the backend ^[4]. The report leaves out how a developer overrides that selection.

Logan Iyer, Microsoft's corporate vice president for Windows Platform and Developer, announced general availability on the Windows Developer Blog ^[2]. It came 127 days after the SDK's early preview at Build on June 2, when Microsoft described it as a cross-platform layer for Windows and WSL ^[18][12]. The repository labels several backends experimental ^[16]. RuntimeWire says that means general availability does not cover every isolation option at the same maturity ^[16].

We think Microsoft put the boundary at the right layer. A permission the agent cannot edit has to sit below the agent, and a single policy format that three operating systems enforce through their own mechanisms is careful engineering ^[6].