Tracekit Box locks agent actions behind signed, fuzz-tested approvals

Tracekit Box runs AI agents inside isolated micro-virtual machines. Each action the agent can take outside that machine, such as a network call or a file write, must appear on a signed list before the agent runs. The operator compiles that list in advance. No action is possible unless the operator named and approved it first. The researchers tested the system with random and malformed inputs to find failures. The published results show where the boundaries held and where they did not. A working implementation paired with real failure data makes this primary-source evidence for teams building agent infrastructure, not a theoretical proposal. The central lesson is this: the operator decides the reach of an agent before it starts. The system refuses to expand that reach once the agent is running. The agent cannot acquire new capabilities by discovering them mid-task. That answers the problem of an agent doing something the original task did not cover. It shifts the design question from catching the agent after it goes wrong to helping the operator declare the right limits before it starts.