Your Agent Doesn't Get Root

Every team has someone running an agentic CLI now, with access to their filesystem, credentials, and network connection. Ask what stops it doing something catastrophic, and the honest answer is usually a paragraph in a system prompt. That's a request, not a boundary, and it won't survive a security review.

This talk shows a different arrangement: the agent gets a brain and no hands. It runs sandboxed with no credentials and no outbound network access, the only actions available are the ones exposed as n8n workflows. Adding a capability means adding a node; removing one means deleting a node. Nothing is buried in agent code, and the complete list of what the agent can do is a canvas anyone can read, including whoever has to sign it off.

We'll demo three things live: an agent blocked at the network layer, a new capability added with no redeploy, and a write action blocked by an approval gate the agent can't route around, then try to argue our way past that gate, and fail. The demo runs on NVIDIA's NemoClaw, but the pattern is agent-agnostic.

• Understand why a system-prompt instruction is a request, not a security boundary, and why it won't pass a security review
• See a sandboxed agent architecture where the only available actions are the ones exposed as n8n workflows
• Watch three live demos: an agent blocked at the network layer, a new capability added without redeploying, and a write action stopped by an approval gate
• Discover why the pattern holds regardless of which agent or sandbox is used