Leadership1 publisher2 min readPublished
Windows takes over enforcing the agent limits developers declare
Microsoft's Execution Containers SDK, previewed at Build 2026, lets a developer state what an agent may touch and leaves Windows to apply that at runtime, with Entra and Intune setting the policy per agent.
The Board Room · Leadership desk
What happened
- A Windows Developer Blog post dated June 2, 2026 says containment, identity and manageability are now built as foundational primitives in Windows, extending security beyond the app and the model into the OS.
- At Build 2026 Microsoft introduced an early preview of the Microsoft Execution Containers SDK, a cross-platform, policy-driven execution layer for agents running on Windows and WSL.
- Microsoft said in May that Agent 365 would discover and manage local agents on Windows, starting with OpenClaw and extending soon to GitHub Copilot CLI and Claude Code.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- constraint The described route from an IT policy to an agent's runtime limits runs through Agent 365, Entra and Intune, so a company whose identity or device management sits elsewhere cannot apply these guardrails without adding that stack.
- decision Because the first agents in scope for discovery include two that Microsoft does not build, the question in front of a security team is whether the endpoint can contain whichever agent a developer installs.
- exposure Microsoft's own framing concedes that an uncontained agent carries the full authority of the user's session, which is the exposure sitting on machines that already run coding agents today.
- precedent If declared constraints become the contract the OS enforces, agent developers shipping on Windows will be expected to state their limits in a form Intune can act on.
In Microsoft's account the developer defines what to constrain inside an app or agent. Windows applies those constraints consistently at runtime through MXC, offered as an abstraction layer across isolation primitives so developers do not manage low-level isolation details [3][4]. The same policy model and SDK can map to different isolation constructs depending on the workload, a design the company calls the composable sandbox [5]. Process isolation is the first option named: lightweight containment inside the user's environment, for cases such as running model-generated code in a dedicated process boundary that restricts access to files and network domains [6].
Agent 365's policy-based controls with Microsoft Entra and Intune will be used to apply those MXC constraints to a given agent [7]. That places three Microsoft services above the operating system in the path between an IT decision and an agent's runtime limits [8]. The post describes only that path, so a company running identity or device management outside Entra and Intune has nothing here to plan against.
Microsoft's stated reason for containment is the non-determinism. Agent behaviour is dynamic and often generated at runtime, with the agent using models to produce complex code for each prompt that can read, act and chain operations. Containment is meant to let the agent do useful work without being granted the full authority of the user's session [9][10]. In May the company said that "beyond monitoring, organizations will be able to apply policy-based controls to set guardrails for what agents are allowed to do" [11].
The containment options are due in early preview shortly after Build, with additional functionality and security enhancements in subsequent releases [12][13]. The narrower thing a buyer can test this quarter is inventory. Agent 365's local-agent discovery on Windows starts with OpenClaw and is set to extend to GitHub Copilot CLI and Claude Code [2]. Those are the coding agents most likely already sitting on developer machines without a policy attached.
If containment, identity and manageability are OS primitives [1], the agent a team picks becomes the replaceable part. The endpoint and identity stack becomes the part that is hard to change. A pilot run on the preview this quarter is also a decision about which policy engine holds the guardrails when the previews ship.
What to watch
- Whether the post-Build early preview includes isolation options beyond process isolation, and on what release schedule.
- Whether Agent 365 discovery actually reaches GitHub Copilot CLI and Claude Code, and what policy it can apply once it does.
- Whether Microsoft describes any enforcement path for organisations whose identity or device management sits outside Entra and Intune.