AI curriculum

Course outline for Agent Execution Environments

An agent that can execute code or use an authenticated browser can affect more than its working directory. Select execution capabilities from a threat model and compare isolation choices before running a disposable task. Verify denial, time limits, revocation, and cleanup within the protections actually configured.

Technology: Agentic Systems
Duration: 6 hours
Modules: 3 · 2 hours each
Level: Level 3

About Agent Execution Environments

Agent Execution Environments Course Objectives

Select code, API, browser, or computer capabilities from task needs and data sensitivity.
Distinguish authenticated-browser authority from interface convenience.
Compare container, microVM, and isolate boundaries using supplied artifacts.
Configure or inspect restricted file, network, and resource controls.
Test a denied action and timeout cleanup in a prepared environment, or explicitly identify the limits of simulator-only evidence.
Record residual risk and justify the cost of the selected isolation approach.

Pre-requisites

Agentic AI Foundations or equivalent understanding of agent actions and delegated authority.
Command-line and basic container experience.
Familiarity with agent tools and operating system permissions.
Advanced microVM or isolate administration is not required for the guided comparison.

Before this course

Complete the required courses or bring equivalent experience. Recommended courses add useful depth; they are not enrolment gates.

Required preparation

Agentic AI Foundations

Recommended preparation

Understands agent actions and authority; basic containers, shell, and OS permissions are still required even without the full cloud-native course.

Find your place in the learning map

Lab Setup

Computer with a prepared local container runtime and restricted disposable workspace, or supplied isolation/cleanup traces with a local policy simulator.
Synthetic files, harmless denial fixtures, dummy credentials, and a disposable browser profile; no authenticated personal browser is used.
MicroVM, isolate, and hosted-service coverage uses guided version-labeled artifacts; no privileged host changes, live service account, or production credentials are required.

Detailed Course Outline

Module 1: Select only needed capabilities (2 hours)

Code execution: Required runtime capabilities, file access, and resource budgets; choose the smallest execution surface that can perform the synthetic task.
Browser control: Direct APIs, authenticated CDP access, dedicated profiles, and extension integration; distinguish integration choices from headed or headless display modes.
Computer use: Interface-level actions, session authority, and sensitive state; compare broad desktop interaction with narrower APIs or dedicated browser capabilities.
Containers: Prepared filesystem, process, network, and resource restrictions; inspect permitted inputs and denied writes without treating packaging as complete isolation.

Practical outcome: Threat-model a synthetic task, compare direct API access with a dedicated browser, and inspect a prepared restricted container while treating authenticated sessions and debugging endpoints as authority boundaries.

Module 2: Compare isolation mechanisms (2 hours)

Sandboxes: Threat models, allowed capabilities, and enforcement evidence; distinguish actual denial controls from labels, prompts, or simulated policy records.
MicroVMs: Virtualized execution boundaries, resource overhead, and lifecycle assumptions in supplied artifacts; compare isolation trade-offs without promising complete protection.
Isolates: Runtime-level separation, supported capabilities, and resource restrictions in supplied artifacts; compare boundary assumptions with containers and microVMs.

Practical outcome: Compare supplied configuration and execution artifacts for filesystem, network, process, and resource isolation; identify assumptions and overhead without claiming one mechanism guarantees complete protection.

Module 3: Enforce a disposable lifecycle (2 hours)

Hosted sandboxing services: Version-labeled service examples, data handling, and operating responsibility; compare documented restrictions and costs without assuming equivalent vendor protections.
Security boundaries: Authenticated sessions, debugging endpoints, file paths, and network destinations; identify authority granted by each capability and remaining untested protections.
Ephemeral environments: Disposable workspaces, timeouts, capability revocation, and cleanup checks; distinguish verified process and file cleanup from simulator-only lifecycle evidence.

Practical outcome: Specify data minimization, capability revocation, timeout, and cleanup, inspect a version-labeled hosted-service example, and verify a disposable local lifecycle within its documented limits.

Practical exercise

Produce an execution threat model, capability policy, disposable-task trace, and cleanup checklist.
Permit reading the supplied synthetic input; deny writing outside the allowed workspace and an unapproved network destination through configured controls or explicit simulation.
Inject a timeout, then check zero surviving task processes and no retained task files in the designated disposable workspace using supplied verification steps.
Explain the authority of the disposable browser profile and identify at least two protections not established by the lab.

What you will produce

Choose bounded execution controls and verify denied actions and timeout cleanup in a prepared disposable environment, or evaluate clearly labeled simulated evidence without claiming host isolation.

How the work is checked

Capabilities and data access are justified by the task threat model.
Allowed and denied file/network cases match enforced or explicitly simulated policy.
Timeout verification checks actual task processes/workspace contents in the executed route, or simulated records only in the simulator route; the report labels which evidence it used.
The comparison distinguishes isolation mechanisms, authenticated authority, overhead, and residual risk.

Six hours using one prepared disposable environment or explicit simulator, with exercises inside module time. Browser comparison distinguishes existing authenticated CDP access, a dedicated profile, and extension integration from the separate headed/headless choice. In simulator mode, cleanup checks concern simulated records only; actual process/file cleanup needs an executed environment and independent host checks. Neither route establishes complete sandbox assurance.

When another approach is better

Use a restricted API instead of browser or computer control when it exposes the necessary capability with narrower authority.
Do not select a complex microVM or hosted sandbox without a threat or resource need that justifies its operating cost.
Do not run untrusted tasks in an authenticated personal browser or an environment whose restrictions are only described in prompts.

How we train

Ask about exercises, instructor feedback and the prior knowledge you need. Tool-specific courses marked provisional may become modules in a broader course.

Discuss your learning goals