When AI starts to install dependencies, run scripts and operate browsers, the content it needs to access is no longer just a prompt word. Google Cloud's October 22 technical article introduced that Agent Compute Engine provides a hardware-isolated microVM execution environment for agents and puts credentials and network control outside the environment. The release materials mark the product as a preview, and the specific opening arrangements should be subject to the official entrance.
Separate the work that needs to be done from the resources that are allowed to be accessed
The execution environment can be understood as a workbench dedicated to the current task: what data is placed, what is allowed to run, and where the results are saved can all be specified in advance. The model is responsible for proposing next steps, and the platform is responsible for limiting the resources it can actually access. The architecture in the article does not mean that small teams must immediately purchase similar cloud products.
To simulate a form sorting task, you can first copy the necessary desensitized samples to a separate directory, so that the process can only generate candidate files, which can be confirmed by a human before entering the business system. Don't hand over the entire company's shared disk and all accounts to it just because the operating environment is "isolated". Whether the isolation is effective needs to be checked from the actual mounting, network exit and permission configuration.
Credentials do not become readable ordinary materials
One design of the official article is to allow the operating environment to not hold background service credentials and to complete authorized access through external control links. The question that small teams can learn from is: If the AI reads a malicious web page, or there is an error in the script, which accounts and data can it access.
When evaluating your own solution, you can check whether the log outputs the key, whether the task data contains the configuration file, whether the network access exceeds the required scope, and whether the call can still be continued after the authorization is revoked. "The system prompt says "disclosure is prohibited" cannot be taken as evidence that access restrictions have been implemented.
Saving the state does not mean that resources can be occupied indefinitely
Long tasks may be paused while waiting for human confirmation, and then require the original files and execution progress when resumed. The official technical introduction discusses this workload of alternating work and wait. The business implementation should separately specify how long the task status is saved, which data is cleared when it expires, and whether authorization should be rechecked during recovery, rather than letting the temporary environment accumulate permanently.
During the trial, first verify one normal completion, one suspension recovery and one authorization revocation. Record the corresponding relationship between the result file and the business object, and then decide whether to expand the use. The above method is recommended by ChinaOPC, and the product has not been deployed or measured this time. Further reading: State recovery after long process interruption.