Code Execution Agent

A code execution agent generates code from natural language and runs it in a sandbox. The risk profile is unlike a traditional application: the agent decides what to write and execute, the “threat actor” and “authorized user” can be the same process, and static analysis doesn’t apply to code that doesn’t exist yet. Governance treats every execution as a first-class, authorizable event. The gateway restricts which tools the agent can call, Cedar rules bound the surfaces it can reach, response filtering strips sensitive data before it flows back to the model, and every call lands in an immutable audit trail.

Threat Model

Threat	Description
Arbitrary code execution	The agent generates and runs malicious or unintended code that escapes the sandbox boundary
Data exfiltration via output	Code output contains file paths, credentials, environment variables, or internal network addresses
Resource exhaustion	Generated code consumes unbounded CPU, memory, or disk, affecting other workloads
Unauthorized system access	The agent accesses filesystem, network, or database resources outside its intended scope

Governance Approach

Threat	Dome Capability	How It Helps
Arbitrary code execution	Register with capabilities, Authorize	Declare code-execution capabilities and permit only sandbox tools
Data exfiltration via output	Guards	Classify output fields containing paths and credentials, redact before returning to the agent
Resource exhaustion	Register with capabilities, Pass identity for delegated agents	Enforce tool-level authorization so the agent cannot invoke resource-intensive tools without the required capability
Unauthorized system access	Authorize, Stream Live Events	Forbid access to production and database tools, audit every tool call for anomaly detection

Implementation

dome agents register \
  --name "code-exec-agent" \
  --capabilities "code-execution"

Configure the sandbox backend

Add the code execution sandbox as a backend with field classifications on sensitive output fields:

dome tool add \
  --name "code-sandbox" \
  --url "https://sandbox.internal:8443" \
  --protocol streamable-http \
  --field-classification output_paths=SENSITIVE,env_vars=SENSITIVE,stderr=PII \
  --gateway Default

--gateway makes the connection reachable through a Gateway; the agent also needs a grant to that Gateway.

Define Cedar authorization rules

Write rules that permit the agent to call only sandbox tools and forbid access to production infrastructure:

dome rules validate code-exec-rules.cedar
dome rules apply code-exec-rules.cedar --name "code-exec-policy"

See the Policy Example below for the Cedar rule content.

Simulate before deploying

Test the rules against historical events to verify they do not break existing workflows:

dome rules simulate code-exec-rules.cedar

Review the DecisionDiffs to confirm that only the intended changes occur.

Enable audit streaming

Stream audit events for real-time monitoring of code execution activity:

dome audit stream --agent code-exec-agent

Every tool call, authorization decision, and field redaction action appears in the audit stream.

Policy Example

code-exec-rules.cedar

// Permit the code execution agent to call sandbox tools
permit(
  principal == Dome::Agent::"code-exec-agent",
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"code-sandbox"
);

// Permit the agent to discover available tools
permit(
  principal == Dome::Agent::"code-exec-agent",
  action == Dome::Action::"mcp:discover",
  resource
);

// Prevent the code execution agent from calling production-deploy.
forbid(
  principal == Dome::Agent::"code-exec-agent",
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"production-deploy"
);

// Prevent the code execution agent from writing to databases.
forbid(
  principal == Dome::Agent::"code-exec-agent",
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"database-write"
);

Cedar evaluates all rules against every request. If any forbid matches, the request is denied regardless of permit rules. The default decision when no rule matches is deny.

Next steps

Authorize Access to write and deploy Cedar
Tools to attach sandboxes and catalogs
Multi-Adapter Tools Agent for multiple tool adapters
Develop to authenticate and route runtime traffic

Get Started

Role

Production

Examples

Code Execution Agent

Threat Model

Governance Approach

Implementation

Policy Example

Next steps

​Threat Model

​Governance Approach

​Implementation

​Policy Example

​Next steps

Threat Model

Governance Approach

Implementation

Policy Example

Next steps