About This Article
This article is created using an automated generation workflow leveraging generative AI. While it is organized based on source information, physical device verification has not been conducted by the author.
Verification Status: unverified (physical device not verified)
Microsoft Execution Containers (MXC) are a policy-driven execution isolation infrastructure introduced as Generally Available (GA) that restrict permissions at the OS level, such as file and network access available to AI agents and dynamically generated code. By externally enforcing boundaries defined by developers and administrators, it reduces the risk of agents performing operations beyond user expectations.
- Why Agent-Specific Execution Boundaries Are Necessary
- Overview of Microsoft Execution Containers (MXC)
- Four Container Backends Tailored to Use Cases
- Five policy-controlled domains
- Three operation modes to assist with policy creation and validation
- Integration of agent identity identification and organizational management
- MXC Adoption Cases and Ecosystem
- Conclusion
- References
Why Agent-Specific Execution Boundaries Are Necessary
AI agents autonomously perform tasks across diverse system resources, including file operations, command execution, and network communication. However, agents cannot be granted independent security judgment authority. This is because even actions deemed "valid" by the model or tool to achieve a task may deviate from the permission scope intended by the system administrator.
Primary sources cite the example of a coding agent tasked with updating a website. Even if the agent needs to reference production server configuration information to understand the build and deployment status of changes, it should not be granted permission to rewrite those configuration files. In an environment where execution boundaries are unmanaged, the agent might rewrite production configurations as the shortest path, risking service outages.
MXC enforces boundaries such as "allowing reads but denying updates" through OS-level policies independent of the agent's internal logic, providing a mechanism to contain the scope of impact within those boundaries even if accidental malfunctions or unintended modifications occur.
Overview of Microsoft Execution Containers (MXC)
MXC is a policy-driven layer designed to execute workloads dynamically generated by untrusted code or models. It can isolate arbitrary units within containers, including not only entire agents but also model-generated code, plugins, individual tools, and agent harnesses.
Developers define resource requirements using a unified JSON configuration schema and multi-language SDKs. MXC automatically maps these requirements to the sandboxing mechanisms native to the target OS—such as Windows, macOS, and Linux—allowing the application of identical policy models without requiring awareness of OS-specific implementations.
Additionally, the primary sources note that MXC usage is generally available not only on local devices but also on Windows 365 Cloud PCs, enabling consistent agent isolation across both cloud and local environments.
Four Container Backends Tailored to Use Cases
MXC provides multiple backends depending on the nature of the workload, security requirements, and required responsiveness.
| Backend | Provided OS | Suitable Workload | Key Features |
|---|---|---|---|
| Process container | Windows 11, macOS, Linux | Lightweight workloads requiring low latency, such as model generation code and tool execution | Utilizes OS-specific process sandboxes such as AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux |
| Session container | Windows 11 only | Long-running agents and automated processes requiring a desktop environment | Runs in an isolated Windows account and session, fully separating the desktop, clipboard, UI, and input boundaries from the interactive user |
| WSL container (WSLc) | Windows 11 only | Agent toolchains dependent on Linux packages and development ecosystems | Provides a Linux execution environment via WSL (Windows Subsystem for Linux) |
| MicroVM | Windows 11, Linux (Experimental feature) | High-risk workloads requiring hardware virtualization boundaries | Provides hardware-based isolation and full Linux workload compatibility |
In particular, the Session container is a Windows 11-exclusive backend characterized by its ability to completely decouple the agent's UI and clipboard from the active user environment, enabling secure execution of automation.
Five policy-controlled domains
Resources accessible to the agent are declared in the MXC policy as OS-enforced boundaries. Rather than delegating full privileges of the signed-in user directly to the agent, only the minimum resources required for the task are allocated.
The five policy-controlled domains indicated in the primary documentation are as follows.
Containment
Specify the type of isolation backend that runs the workload, such as a process container or a session container.Process
Define basic parameters for workload startup, including execution commands, arguments, working directory, and environment variables.File system
Individually specify paths that are allowed read-only access, paths that are allowed write and modify access, and paths where access is completely forbidden.Network
Configure the allowance of inbound and outbound communication. This also includes whether to allow communication via the host's loopback interface (localhost).User interface
Control whether to allow access and interactive operations for desktop screens and UI-related resources.
Three operation modes to assist with policy creation and validation
When creating policies based on the principle of least privilege, it is not easy to cover all the resources required by an agent from the beginning. MXC process containers on Windows provide three operation modes to generate agent activity reports and incrementally refine policies.
| Operation mode | Behavior for unauthorized access | Activity report | Main use case |
|---|---|---|---|
| Enforcement | Block | None | Normal execution in production environments. Strictly applies configured policies. |
| Learning | Block and record | Yes | Diagnosis of failure causes and verification of whether excessive permissions are granted. Unauthorized operations are blocked and output to a JSON report. |
| Permissive | Allow and record | Yes | Investigation prior to policy formulation. Collects logs while still allowing access to targets that would otherwise be denied (does not bypass other OS or organizational restrictions). |
Gradual deployment is possible: observing behavior in Permissive mode, verifying blocking behavior in Learning mode, and ultimately operating in Enforcement mode.
Integration of agent identity identification and organizational management
To establish agent governance, in addition to containment, integration with identity identification and manageability is essential.
According to primary sources, integration with Microsoft Entra will soon be enabled on Windows, allowing Microsoft Agent 365 to distinguish between agent activity and human user activity. Because actions and risks can be evaluated on a per-agent basis, if a specific agent violates a policy, only that agent's access rights can be revoked without interrupting the work or account privileges of the employee using it.
Additionally, management policies via Microsoft Intune will soon be available, enabling IT administrators to centrally manage evaluation criteria for container creation requested by agents on Windows 11 and the applicable resource boundaries.
On the agent development side, when specific resources are blocked by organizational policies, implementations are required to clearly indicate to the user why a task cannot be completed due to insufficient permissions or to select safe alternative means, rather than silently failing abnormally.
MXC Adoption Cases and Ecosystem
MXC is already being adopted and integrated into major agents and development environments.
NVIDIA: Integrated OpenShell into MXC to provide inference services, file access control, advanced network control, credential management, and OCSF audit capabilities for enterprises.
Existing supported tools and frameworks: GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio, Unsloth AI.
Tools scheduled for future supportExamples include Anthropic Claude Code, Box, Egnyte, Heidi Health, Hermes Agent (Nous Research), Manus, Perplexity, Raycast, and Simular.
Development assistance tools such as GitHub Copilot and Replit use MXC to grant access to code and build tools within the project repository while reliably blocking unauthorized access to unrelated personal folders and external networks.
Conclusion
Microsoft Execution Containers (MXC) serve as a crucial foundation for controlling the autonomous execution privileges of AI agents at the OS level.
The requirements and constraints to consider during implementation are as follows.
Pre-deployment Checklist:
Selecting the appropriate backend (Process, Session, WSL, or MicroVM) based on the characteristics of the target workload.
Identifying file paths, commands, and network destinations required by the agent.
Adjusting policies based on activity reports using Learning mode or Permissive mode.
Platform Limitations and Considerations:
Session containers and WSL containers are supported only on Windows 11.
The MicroVM backend is currently in an experimental feature status.
The activity reporting feature is limited to process containers in Windows environments.
Identity-based integration using Entra and centralized policy management using Intune will be available soon (pending rollout).
Because policy deployment and behavior verification have not been performed on actual hardware, refer to the official SDK and repository documentation for environment-specific detailed behaviors.
References
- Microsoft Execution Containers: Policy-driven containment for AI agents: https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/
