OWASP's Top 10 for LLM Applications gives a name to an agent that can do more than its task requires: Excessive Agency. It is a useful phrase for a buyer, because it points at the real question under every "secure AI agents" pitch, which is not "is it sandboxed?" but "what, exactly, is this thing stopping the agent from doing?"
Ask five vendors that question and you will hear five different nouns: sandbox, vault, gateway, remote environment, control plane. The nouns get treated as rival answers to one question. They are not. They are answers to four different questions, and a team that has not separated the questions tends to buy the noun with the best demo and discover the gap in production.
This is a category guide, not a scorecard of named products. The point is to let you walk into any vendor call, including ours, knowing which of the four questions you are trying to answer, what each category is genuinely good at, and where it stops.
Start with the question, not the product
Four questions sit under "secure the agent," and they are genuinely different:
Isolation: what can the agent touch on this machine? Credentials: what can it authenticate as? Action: what is it allowed to do with that access? Evidence: can you prove what it did, from logs you own? A product can be excellent at one of these and silent on the others. The confusion in the market comes from each category answering its own question loudly and leaving the other three implied.
Local sandboxes are strong on isolation and stop at the machine's edge
Local sandboxes do one thing very well: they limit what the agent can touch on the machine it runs on. Filesystem scoping, process isolation, a constrained runtime. If your worry is "the agent deletes my home directory," this is the category that answers it.
Where they stop is the edge of the machine. Many intercept HTTP and little else, so a database wire protocol or a raw socket connection passes underneath. And isolation says nothing about authorization: an agent perfectly sandboxed on the host can still authenticate to production with an inherited credential and run a destructive statement there. Isolation is necessary. It is not the whole question.
Credential brokers and vaults are strong on credentials and stop at authorization
A credential broker or vault answers the second question well: it keeps long-lived keys out of the agent and hands out short-lived, scoped credentials instead. This is real progress, and any serious setup needs it. Keeping secrets out of the agent's environment is the single highest-leverage move most teams can make.
The gap is the line this series keeps returning to: authentication is not authorization. A broker decides what the agent can authenticate as. It does not, by itself, decide what the agent may do once authenticated. A scoped credential still permits every action its scope allows, and "its scope allows" is usually wider than the task.
Remote development environments host the work and do not govern it
Remote development environments solved a genuine problem: every engineer gets a consistent, centrally managed workspace instead of a snowflake laptop. Agents now run in those same workspaces, and the environment gives you central images, compute off the laptop, and a known starting state. Credit where due.
Hosting the place where an agent works, though, is a different job from governing what the agent does there. A remote workspace does not inherently decide which credentials the agent can read, which verbs it may run against production, or where its requests went. Those can be true of a workspace product, but they are a separate layer bolted on, not a property of hosting the environment.
Agent control planes answer all four and cost you an operator
An agent control plane is the category that takes on all four questions at once: isolation, credentials, verb-level action policy, and org-wide audit, with the whole thing self-hosted in your own environment. That breadth is the pitch.
The honest cost belongs in the same breath as the pitch: you operate it. A control plane that runs in your cluster is infrastructure your platform team owns, upgrades and keeps alive. For teams that need agents inside their own boundary, that trade is the point. For a team that wants a hosted checkbox, it is a real commitment, and a buyer's guide that hid it would not be worth reading.
A scoring table you can take into vendor calls
Score categories, not logos, on the capabilities that actually separate them:
- Runs in your own VPC
- Credentials never reach the agent
- A per-request egress log you own
- Verb-level tool policy
- Database statement policy
- Governed headless agents
- Works with any coding agent
Map each category you are considering against those rows. A sandbox will light up isolation and little else. A broker will light up credentials. A control plane should light up most of them, and if a vendor claims every row with no caveats, that is itself a finding.
Questions to ask every vendor, including us
Ten questions worth asking in any call:
- What can the agent touch on the host, and what stops it?
- Where do credentials live, and can the agent ever read one?
- Are actions judged by verb and target, or only by destination?
- Does this cover non-HTTP protocols, including database wire protocols?
- Where does the audit log live, and who owns the storage?
- Can you attribute every request to a session and a person or trigger?
- Can I stop one session without stopping everyone?
- Can I change a policy on running sessions without a restart?
- Which coding agents does this actually support?
- What do you not do yet?
The last one is the tell. A vendor who answers it plainly is a vendor worth continuing with.
Sandbox, vault, gateway, remote environment and control plane are not five answers to one question. They answer four: what can the agent touch, what can it authenticate as, what can it do, and can you prove what it did. Decide which of those you are actually trying to answer before you compare products, score the categories on the rows that separate them, and ask every vendor what they do not do yet. The noun matters far less than the question it is answering.
For the category under the controls themselves, start with the false choice between banning agents and letting them run →
Marshal is an agent control plane you run in your own VPC: isolation, credentials the agent never holds, verb-level policy, and an audit log you own. Book a demo →