The Agent Says It Only Touched One File. Here's How I Made That Provable.

Originally published on LinkedIn on August 15, 2026.

Two posts ago I said the scarce thing, as code gets cheap, is governed intent. Last time was the org schema — a way to make "what even is a legitimate organization" checkable. This one is the other half: a runtime that makes an agent's own account of its work checkable, instead of something you take on faith.

The premise is uncomfortable if you've spent any time handing tasks to a coding agent: you ask it to touch one file, and it tells you it touched one file. Maybe it did. The report you're reading came from the same process you're trying to verify.

So I built Orvena on a narrower promise than "the agent behaves." You declare a task's scope — these files, this step budget — and Orvena enforces it at the OS level, not the prompt level. The distinction is the whole point: a prompt is a request the model can misread, forget, or quietly override while trying to be helpful. A refused syscall isn't a request. The agent doesn't get to interpret it differently — inside that boundary. The boundary itself is the filesystem, not everything the agent can reach: a contained agent can still talk to its own model provider over the network, and that traffic isn't inside the box. What's verified today is macOS; Linux enforcement needs a kernel with Landlock enabled, and the suite says so loudly rather than reporting a pass it can't back up.

I didn't trust that claim from myself either, so I built an adversary with no model in it: fourteen ways to escape a declared boundary — path traversal, symlinks out, backgrounded processes, exec into a fresh shell — each one run twice. Once unconfined, where it has to succeed, so a technique that fails for its own reasons never gets mistaken for one the sandbox caught. Then confined, where it has to fail and leave nothing behind. A positive control runs alongside, because a sandbox that blocks everything, including the actual work, would pass every containment test and mean nothing.

Adversary — no model in it

14 ways to escape a declared boundary

Path traversal · symlinks out · backgrounded processes · exec into a fresh shell

Run 1 — unconfined

Must succeed

So a technique that fails for its own reasons is never mistaken for one the sandbox caught.

Run 2 — confined

Must fail, leaving nothing behind

This is the only leg that tests enforcement, and it is enforced at the OS level, not the prompt level.

Positive control — runs alongside

The real work must still complete

A sandbox that blocks everything would pass every containment test and mean nothing.

A technique counts as contained only when all three hold.

Then I ran the real question: the same task, the same model, the same agent, once ungoverned and once governed, and read the difference instead of asserting it. It's a small, self-hosted signal from one local model on one machine — not a claim I'd stake a benchmark paper on — but it's a real number, and the report it produced doesn't contain a transcript or a prompt, only what the run actually did. The honest caveat: the run that produced it barely got attacked. Every recorded breach was the same trivial thing, and only on the ungoverned leg — nobody tried a redirect, a symlink, or a rename against the governed leg that time. A clean number from a quiet fight isn't the same claim as a clean number from a real one, and I'd rather say that than let the number imply more than it earned.

Orvena doesn't write better code. It doesn't even write code. What it does is turn "the agent said it stayed in scope" into something you don't have to take the agent's word for — which is the same move as the org schema, aimed at a different boundary.

Next: why I think "closed source" isn't actually the moat here, and what is.