The finance team wants a weekly reconciliation of marketplace refunds against seller balances: 6,412 refund lines against 2,000 seller ledger rows, a different question every time somebody changes the fee schedule, and a spreadsheet at the end. No tool surface fits that job. Five topics on giving an agent a computer instead, and on drawing the box it runs in before the first script executes.
5 topics
Every chapter so far has given the agent capabilities you could enumerate. Nine tools with nine schemas, a retriever over a policy library, a state machine with named transitions — surfaces where "what can this thing do" has a printable answer. Reconciliation breaks that, and not because it is hard: because nobody can write down in advance which columns need joining, which refund reason codes count against a seller, or what finance will ask next October. The work is arbitrary computation over data the agent is already allowed to read, and the only thing that fits it is a runtime.
Which is a larger decision than it looks. A general-purpose machine collapses twenty tools into one capability and removes, in the same movement, your ability to say what the agent can do — every guarantee now comes from the boundary around the box rather than from the list of things inside it. So the chapter spends as much time on the box as on the capability: four constraints that make a sandbox, the one teams leave open, why credentials stay outside it, and what containment does not buy you. Verification does the rest of the work, because code produces artefacts that can be checked against invariants and rejected, which is the one advantage this capability has over prose.
Two things stay true throughout. The support queue does not get a runtime: money-moving actions belong in tools with ceilings and approval gates, and that split is a design decision rather than caution. And the environment is where the injection wound of Chapter 12 gets its widest surface — a sandbox with open egress is an exfiltration path, and a browser session is somebody else's prose arriving with the user's own authority attached. The last topic is the least glamorous and the most reusable: a 41-minute run is a queued job, and queued jobs have been a solved problem since long before any of this.
The parent holds the keys, the box holds the computation, and one verified file is the only thing that crosses
Parent process · outside the box, holding every credential
Fetch the exports · start the container · extract the artefact · verify it · publish it under its own identity
What it holdsevery credentialthe audit record
What it puts on the mounttwo CSV files6,412 and 2,000 rows
What it does with the resultfour invariantsreject, never annotate
the boundary — computation crosses in, one checked file crosses out, and no authority crosses in either direction
Container · one per run, and the run is forty-one minutes long
What is in ita pinned imagetwo read-only files
What is deliberately notno credentialno way out
How long it livesone run, then goneeleven scripts, one box