[Feature Request] Runtime guard and policy engine for Python and Node.js agents inside the sandbox

## **Problem:**

Boxlite provides strong hardware-level isolation — the agent runs in its own micro-VM and can't escape. But once access is allowed by sandbox policy (network, filesystem, subprocess), the agent has full freedom inside the box. There's no visibility into how that allowed access is being used.

This creates a blind spot for attacks that operate entirely within allowed sandbox boundaries:

**Supply chain attacks:** a malicious dependency executes code at import time, harvesting secrets from env vars or the filesystem. No sandbox policy is violated because the agent legitimately needs file and env access.
**Data exfiltration:** agent reads sensitive files then sends contents to an allowed host by encoding data into API request bodies. The sandbox sees a permitted HTTPS connection to an allowed domain — it can't inspect what's inside the payload.
**Command injection:** a crafted MCP tool response ends up as an argument to subprocess.Popen(). The sandbox allows subprocess because the agent needs it. The dangerous part is the argument, not the syscall.
**Deserialization RCE:** agent unpickles attacker-controlled data from an external source. The sandbox can't distinguish a legitimate unpickle from a weaponised one — both are valid Python function calls.

**Behaviour the sandbox can't see**

A sandbox sees syscalls. A runtime guard sees drift from baseline. A normal agent session calls requests.post() via the requests library to an allowed host with expected arguments. A compromised agent — after prompt injection or tool poisoning — starts reading .env files it never touched before, calling socket.connect directly instead of through HTTP libraries, or spawning subprocess.Popen from an unknown package. Every call is individually allowed by sandbox policy. The drift from normal behaviour is what makes it an attack — and only something watching at the language level can see that.

## **Reference**
The diagram below shows the flow from prompt to kernel — the runtime guard layer sits between the agent's stdlib calls and the syscall boundary, which is the gap the sandbox doesn't currently cover:

More details: https://ir2re.fyi/posts/runtime-guard-for-ai-agents/

## **Proposal**
Consider adding an optional runtime guard that hooks into the language runtime (Python/Node.js) inside the sandbox to provide argument-level and caller-level context for function calls — things the VM boundary can't see. The sandbox remains the isolation layer; the runtime guard adds detection and blocking for malicious behaviour within allowed boundaries.

Beyond blocking, the runtime guard could also establish a baseline identity for each agent — binding its expected model, tools, and call patterns to the box — so that any deviation from normal behaviour is flagged as drift. This is critical for agentic security because agents are non-deterministic by nature; static policies alone can't catch an agent that starts behaving differently mid-session due to prompt injection or context poisoning.

In terms of where this fits in Boxlite's architecture: the runtime guard sits inside the OCI container as an in-process module that loads before the agent starts, since it needs language-level APIs that only exist inside the Python/Node.js runtime. The policy engine sits on the host side alongside the BoxLite Runtime, pushing rules into the guest at box creation and receiving security events back via the existing vsock/gRPC channel — keeping policy management and audit logging outside the trust boundary of the agent.

Happy to contribute and discuss further.

Start by mapping the existing BoxLite Runtime and its vsock/gRPC channel, then determine how an in-process Python/Node.js guard would load inside the OCI container. Define the policy, baseline, event, and blocking boundaries before implementation; the issue does not name specific files, tests, or acceptance criteria.

Written by the indexing model from the issue text.