Microsoft MXC became generally available on October 7: define an agent’s boundaries

Separate confirmed status from environment-specific availability

The announced approach lets a developer or organization define resource policy, with the execution environment constraining the workload. Our focus is who controls permissions and which actions can occur. Better model answers do not themselves establish safer execution authority.

Check the application’s support, selected backend and system requirements individually. Generally available capabilities, experimental backends and forthcoming management features cannot be combined into a claim that every user has everything today. Account, organizational policy and application version also require their own checks.

Editorial example: turn report generation into a resource scope

This is a KitNelo discussion example, not official configuration or an observed security test. The task reads three fictional sales records and produces an HTML summary. The owner should define read-only inputs, a separate writable output directory, network access and required executables.

Specify what a completed report must contain before deciding resource scope. Identify destinations when public research is necessary. A sample-only task should not receive network access merely because the model wants to search. Record missing resources on failure so the responsible person can decide whether they are necessary.

Verify effective boundaries before adoption

1. 1
   Record application, version, system, execution backend and integration guidance. Confirm availability in the actual environment.
2. 2
   Use disposable copies without personal or production data. Complete the normal report task, confirming sufficient permissions and unchanged inputs.
3. 3
   Have a developer prepare harmless boundary cases, such as accessing an unauthorized sample file or writing beyond the sample scope, and inspect expected denials.
4. 4
   Record denied actions, reasons and report locations. After changing permissions, rerun normal and boundary cases and retain the differences.

These are editorial acceptance ideas. They do not replace organizational security assessment or establish that one backend suits every sensitive workload.

Decide whether the task needs a desktop before choosing a backend

The announced backends are not four interchangeable safety-level buttons. Process containers use platform sandboxes on Windows 11, macOS and Linux. Session containers are Windows 11-only and separate desktop, clipboard, UI and input. MicroVM is experimental on Windows 11 and Linux. Start with the application’s required capabilities, then verify what its backend supports on the actual system instead of ranking names.

Invented task A creates static HTML from an authorized CSV without desktop interaction. Task B also operates a desktop demonstration application. A should not receive access to the personal desktop or clipboard merely because it might be useful. For B, the developer must explain how desktop operations are separated; A successfully producing a file inside a process boundary does not establish that B’s desktop interactions are properly isolated. If the application supports only an unsuitable backend, narrow the task or change the implementation rather than treating MXC availability as every capability being integrated.

This choice also does not identify where inference happens. A locally executed tool and a model request to a cloud service are separate data paths. Ask the developer to explain input, output and model-request flows individually. An unexplained external connection in a task that needs no network is a reason to investigate, not to infer that data stayed on-device because execution was called local.

Require a correct report and the expected boundary denial

Use a separate, smaller invented sample: two same-currency amounts, 40 and 60, and permission to generate a report totaling 100 in output. Prepare a nonsensitive sample-outside file that is explicitly outside the authorized scope. A developer should design harmless boundary cases in a controlled environment and record normal output separately from boundary behavior. This is not a probing command for a real system.

Confirm the operating mode first. For Windows MXC process containers, Learning blocks and records ungranted access; Permissive allows and records it; Enforcement blocks without this activity report. A request appearing in a report therefore does not alone establish a denial. Observing activity while authoring policy and accepting an enforced boundary are different conditions. Do not assume the same reporting capability on other systems or backends.

If the report shows 100 but the outside sample is also rewritten, content passes while the authorization boundary fails. If the outside action is denied but a missing output-directory permission prevents report generation, one boundary check passes while functionality fails. Add only the necessary output location and rerun both cases instead of temporarily allowing the entire user directory.

A usable report, unchanged original inputs, expected denials for the harmless outside cases, and an explained effective application/backend configuration together form this limited acceptance. Leave observations unconfirmed when adequate runtime records are unavailable. Even a pass still needs source-instruction review and arithmetic checks; containment does not fact-check the report.

Content accuracy and execution permissions need separate review

A constrained agent can still miscalculate, omit information or react to instructions inside source material. Review document instructions and prompt injection to separate task instructions from evidence. A completed execution still needs content checks.

Local execution, local inference and prohibited networking describe different conditions. Connected services also have external permissions; see AI connected-app permission and result checks. Use the effective application policy rather than inferring data flows from a local label.

If an application does not explain integration or effective policy, ask its maintainer before adopting it. This article does not document installing MXC, changing system permissions or penetration testing on a reader’s device. Its cover is an original task illustration, not a Microsoft screenshot.