[Blog](https://cohesivity.ai/blog) Architecture Published Jul 22, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/arag.webp)![](https://cohesivity.ai/authors/anshu.webp)[Arag](https://www.linkedin.com/in/aragagrawal/) and [Anshu](https://www.linkedin.com/in/aanshuaggrawal120/) # The AI Agent Compute Escalation Ladder: Function, Sandbox, or VM? [Read as Markdown](https://cohesivity.ai/blog/ai-agent-compute-escalation-ladder.md) Workload Route Compute Isolated Choose agent compute by the workload’s code trust, network access, credentials, lifetime, filesystem, state, and resource bounds. A scoped API call needs no sandbox. Untrusted generated code needs isolation that a normal application process or container configuration may not provide. The escalation ladder prevents a simple database read from receiving a filesystem and shell, while keeping risky code away from long-lived application credentials. ## Use the lowest tier that satisfies the task ```mermaid flowchart TD A[Scoped API call] -->|needs application logic| B[In-process function] B -->|needs async or longer work| C[Background job] C -->|needs package or process isolation| D[Isolated process or container] D -->|runs untrusted code| E[Hardened sandbox] E -->|needs full machine control or long-lived isolation| F[Dedicated VM] ``` Escalation adds capability and operational work. It does not automatically add safety. A sandbox with unrestricted network access and production credentials can be more dangerous than a narrow server-side API. ## Tier 0: scoped API call Use a typed backend operation when the task is already expressible as a database query, object read, email send, or deployment request. The agent supplies bounded arguments, and the server owns credentials, authorization, validation, and audit. This tier has no general code execution. It is the right default for ordinary product actions and aligns with [semantic tool design](https://cohesivity.ai/blog/why-semantic-apis-are-better-for-ai-agents). ## Tier 1: in-process function Use application code for short, trusted transformations and orchestration that fit the request lifecycle. Restrict available modules and keep provider secrets outside model-visible input. Do not run generated code with `eval`, a shell, or dynamic imports in this tier. A timeout stops the request from waiting, but it does not reliably stop every child process or external effect. ## Tier 2: background job Move work to a queue when it can exceed a request timeout, needs scheduled retries, or should be rate-controlled independently. Persist an operation record and make the job idempotent because queues may deliver more than once. A job worker is durable scheduling, not a security boundary. It usually runs trusted application code with access similar to the service. The [durable execution guide](https://cohesivity.ai/blog/durable-execution-for-ai-agents) covers checkpoints and unknown outcomes. ## Tier 3: isolated process or container Use a separate process or container for trusted code that needs packages, a filesystem, or different CPU and memory limits. Drop privileges, use a read-only base filesystem where practical, mount only required files, and restrict outbound network access. A container shares a host kernel unless the platform adds a stronger boundary. Treat it as workload packaging and process isolation, then evaluate whether its runtime configuration matches the threat model. ## Tier 4: hardened sandbox Use a sandbox for untrusted or model-generated code. Give each run an ephemeral filesystem, strict CPU, memory, process, and wall-clock limits, and an outbound network allowlist. Inject only task-scoped credentials, then revoke them and destroy the environment after the run. Persist approved outputs to object storage before cleanup. Scan artifacts and avoid returning unlimited stdout or binary content to the model. The [sandboxing guide](https://cohesivity.ai/blog/sandboxing-ai-agents-secure-code-execution) covers escape paths and test cases. ## Tier 5: dedicated VM Use a dedicated virtual machine when the task needs its own kernel boundary, privileged system behavior, unusual dependencies, a long-lived desktop, or customer-specific isolation. Harden the image, control metadata-service access, patch it, and define teardown. A VM should not become permanent merely because an agent once used it. Long-lived machines accumulate credentials, files, packages, and network trust. Rebuild from a known image when persistence is not required. ## Classify six requirements before choosing a tier 1. **Code trust:** Is every instruction and dependency controlled by your team, or can a user or model supply code? 2. **Authority:** Which credentials and resources must the workload reach? 3. **Network:** Does it need no network, a fixed allowlist, the public web, or private services? 4. **Lifetime and state:** Does it finish in seconds, wait for hours, or require a persistent machine? 5. **Runtime surface:** Does it need a shell, browser, package install, writable filesystem, kernel feature, or GPU? 6. **Resource bounds:** What CPU, memory, process, output, and spend limits stop runaway work? Cloudflare’s [Project Think](https://blog.cloudflare.com/project-think/) describes a related tiered design for agent workloads. The exact product mapping is provider-specific; the transferable idea is to escalate from narrow operations toward isolated compute only as requirements demand it. ## Test the boundary, not the label Verify filesystem mounts, network egress, secret visibility, process limits, termination, artifact export, and cleanup. Attempt to reach a disallowed host and another tenant’s resource in an isolated environment. Confirm that the platform records which image, policy, identity, and operation created the run. The prompt below classifies the current workloads before proposing infrastructure. It often finds tasks that can lose a shell entirely, which is a clearer security improvement than renaming a container a sandbox. or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+repository%27s+AI+agent+workloads.+Do+not+edit+code+or+execute+untrusted+input.+For+each+workload%2C+classify+code+trust%2C+required+network+destinations%2C+credentials%2C+filesystem+needs%2C+maximum+lifetime%2C+state%2C+CPU+and+memory+bounds%2C+latency+target%2C+and+cleanup+behavior.+Place+it+at+the+lowest+safe+tier%3A+scoped+API+call%2C+in-process+function%2C+background+job%2C+isolated+process+or+container%2C+hardened+sandbox%2C+or+dedicated+VM.+Flag+workloads+that+have+broader+access+than+their+requirements+justify+and+explain+the+smallest+safe+downgrade+or+required+isolation+control. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+repository%27s+AI+agent+workloads.+Do+not+edit+code+or+execute+untrusted+input.+For+each+workload%2C+classify+code+trust%2C+required+network+destinations%2C+credentials%2C+filesystem+needs%2C+maximum+lifetime%2C+state%2C+CPU+and+memory+bounds%2C+latency+target%2C+and+cleanup+behavior.+Place+it+at+the+lowest+safe+tier%3A+scoped+API+call%2C+in-process+function%2C+background+job%2C+isolated+process+or+container%2C+hardened+sandbox%2C+or+dedicated+VM.+Flag+workloads+that+have+broader+access+than+their+requirements+justify+and+explain+the+smallest+safe+downgrade+or+required+isolation+control. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+repository%27s+AI+agent+workloads.+Do+not+edit+code+or+execute+untrusted+input.+For+each+workload%2C+classify+code+trust%2C+required+network+destinations%2C+credentials%2C+filesystem+needs%2C+maximum+lifetime%2C+state%2C+CPU+and+memory+bounds%2C+latency+target%2C+and+cleanup+behavior.+Place+it+at+the+lowest+safe+tier%3A+scoped+API+call%2C+in-process+function%2C+background+job%2C+isolated+process+or+container%2C+hardened+sandbox%2C+or+dedicated+VM.+Flag+workloads+that+have+broader+access+than+their+requirements+justify+and+explain+the+smallest+safe+downgrade+or+required+isolation+control. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+repository%27s+AI+agent+workloads.+Do+not+edit+code+or+execute+untrusted+input.+For+each+workload%2C+classify+code+trust%2C+required+network+destinations%2C+credentials%2C+filesystem+needs%2C+maximum+lifetime%2C+state%2C+CPU+and+memory+bounds%2C+latency+target%2C+and+cleanup+behavior.+Place+it+at+the+lowest+safe+tier%3A+scoped+API+call%2C+in-process+function%2C+background+job%2C+isolated+process+or+container%2C+hardened+sandbox%2C+or+dedicated+VM.+Flag+workloads+that+have+broader+access+than+their+requirements+justify+and+explain+the+smallest+safe+downgrade+or+required+isolation+control. "Send to OpenCode")