core/devops/autonomous_least_privilege_environments.md
Autonomous, Least-Privilege, Portable Execution Environments
What least privilege actually means for an autonomous AI coding agent that runs shell commands: sandbox primitives (bubblewrap/Seatbelt/gVisor/Firecracker), capability dropping, ephemeral scoped credentials, and named 20...