Private Linux desktop per bot. Host files off-limits. View-only by default, human takeover, vault for secrets. Swap Grok / Claude / Codex / Ollama on the same task — isolation as an eval harness, not a demo mouse.
Isolation so the model can act without owning the host. Model-agnostic sandbox for coding agents.