On October 7 (U.S. time), Microsoft announced the general availability
on Windows 11 of Microsoft Execution Containers (MXC),
which controls the scope of what AI agents can do when they run.
Developers and IT administrators define the files and network access
an agent may use, and those restrictions are enforced at runtime.
It is a mechanism that sets boundaries on accessible resources
on the execution environment side when delegating work to AI.
What Changes: A Boundary Agents Cannot Expand on Their Own
With MXC, the files, network destinations, and other resources
an agent may access are defined in a policy outside the agent’s control.
Microsoft explains that this creates a boundary
in which neither the agent nor the code it runs
can grant itself additional access.
In an example from the company, a coding agent updating a website
is allowed to read and write the source code
but can only read the server configuration.
Even if the agent decides that a configuration change is needed,
the execution environment blocks any write that has not been granted.
The tools and plugins the agent uses are also covered by these controls.
Execution Environment Design: A Common Policy and Multiple Isolation Methods
According to the developer blog, MXC uses a JSON policy format and an SDK
and is designed to support execution environments
on Windows, macOS, and Linux.
Process-level isolation is available on all three operating systems,
and Windows 11 also offers a method using a separate account and session.
Isolation properties differ by method,
and MicroVM, which uses hardware virtualization, is described as experimental.
According to Microsoft’s announcement, Codex, GitHub Copilot, Replit,
LM Studio, and others already support MXC.
Support from Claude Code and others is listed as upcoming,
distinguished from products that support it today.
Activity Recording to Help Refine Permissions
On Windows, process containers can record the resources
an agent attempted to access.
In addition to the standard Enforcement mode,
two modes with recording are available.
Learning mode blocks and records operations that have not been granted,
while Permissive mode allows operations to continue
and records what would otherwise have been blocked.
Even in Permissive mode, other restrictions set by the operating system
or the organization cannot be bypassed.
LC Signal’s Perspective: Separating Delegated Work from Administrator Authority
The agent can change the source code but not the server configuration.
Microsoft’s example draws a concrete line
between the work delegated to an agent
and the authority retained by administrators.
Designing permissions to match each task
seems likely to become a practical part of adoption.
While several development tools already support MXC,
the ability to manage Windows 11 process containers from Intune
is still to come.
Beyond the runtime controls available with this general availability,
how capabilities for distributing and managing policies across organizations develop
will be a point to check when considering enterprise use.
Key Sources
-
Microsoft official developer blog:
Microsoft Execution Containers: Policy-driven containment for AI agents
-
Microsoft official blog:
Building Windows for hybrid intelligence
This article was prepared with AI assistance using publicly available information
as of October 8, 2026.
Announcement dates follow the dates shown on the official pages.
Planned features and products are distinguished from those currently available.
“LC Signal’s Perspective” reflects this publication’s interpretation
of the available information.