I have been working on putting agents into full gVisor isolation with a default deny egress proxy that includes secret injections. When an agent tries to connect outbound, by default it suspends the gVisor, holds the proxy connection open, and lets the user choose.

I am adding external judges now. But, there is a hypervisor key you press to deny/allow hosts without switching terminals.

I just can't get behind relying on the harness tool boundry to protect me.