--- schema: 1 type: video title: 'What if the network was the sandbox? — Remy Guercio, Tailscale' description: >- Standard sandboxing puts the API key inside the sandbox. The agent has the key, which it can exfiltrate, misuse, or — if it runs long enough — find creative ways to leverage beyond its intended scope. Remy Guercio from Tailscale argues that sandboxing conflates two separate problems: execution isolation and access control. You can fully isolate a runtime and still have the agent holding credentials it can abuse. Their answer is Aperture, an LLM gateway built on Tailscale's WireGuard identity network. Every connection carries verified identity — user, tag, or group — and the agent gets a placeholder instead of a real key. There is nothing to exfiltrate. Every LLM call has to pass through the network layer, so Aperture sees every tool call, bash command, and MCP request without instrumentation inside the container. Internally at Tailscale, bash dominates over structured tool calls — and now they can actually see that. Speaker info: - https://www.linkedin.com/in/remyguercio/ Timestamps: 0:00 - Introduction and the concept of a sandbox 1:15 - Breaking down the components of a sandbox (boundary and permissions) 1:52 - How permissions are typically handled (API keys vs. OIDC) 3:18 - Introducing Tailscale and WireGuard for network-level identity 5:42 - Introduction to Aperture (AI Gateway) 7:28 - Live demo: Viewing usage metrics and logs in Aperture 9:47 - Live demo: Inspecting GitHub Actions PR review bot logs 10:39 - Visibility into tool calls, bash commands, and MCP requests 11:46 - Agent setup and configuration in Aperture 13:59 - Advanced features: Cost controls, quotas, and webhooks 15:35 - Using tsnet to build custom internal identity-aware services 17:03 - Q&A: How to configure permissions (Grants vs. ACLs) 18:46 - Q&A: Network-layer transparency for base URLs 20:25 - Q&A: Permissioning based on users vs. model/provider 21:28 - Q&A: Handling non-tool call agent behaviors (direct code execution) --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/BM2JX9hqsVQ-what-if-the-network-was-the-sandbox Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/what-if-the-network-was-the-sandbox-remy-guercio-ta-ddb075a95738 markdown: >- https://liquidgold.cc/channel/aidotengineer/video/what-if-the-network-was-the-sandbox-remy-guercio-ta-ddb075a95738.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T10:02:19.568Z' language: null children: [] videoId: BM2JX9hqsVQ durationSeconds: 1469 publishedAt: '2026-06-01T15:00:31.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 25 endSeconds: 81 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=25' heldReason: rights - ordinal: 1 text: null startSeconds: 81 endSeconds: 92 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=81' heldReason: rights - ordinal: 2 text: null startSeconds: 124 endSeconds: 200 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=124' heldReason: rights - ordinal: 3 text: null startSeconds: 124 endSeconds: 200 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=124' heldReason: rights - ordinal: 4 text: null startSeconds: 200 endSeconds: 210 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=200' heldReason: rights - ordinal: 5 text: null startSeconds: 210 endSeconds: 344 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=210' heldReason: rights - ordinal: 6 text: null startSeconds: 210 endSeconds: 344 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=210' heldReason: rights - ordinal: 7 text: null startSeconds: 355 endSeconds: 454 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=355' heldReason: rights - ordinal: 8 text: null startSeconds: 355 endSeconds: 454 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=355' heldReason: rights - ordinal: 9 text: null startSeconds: 467 endSeconds: 588 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=467' heldReason: rights - ordinal: 10 text: null startSeconds: 600 endSeconds: 646 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=600' heldReason: rights - ordinal: 11 text: null startSeconds: 646 endSeconds: 657 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=646' heldReason: rights - ordinal: 12 text: null startSeconds: 657 endSeconds: 712 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=657' heldReason: rights - ordinal: 13 text: null startSeconds: 712 endSeconds: 723 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=712' heldReason: rights - ordinal: 14 text: null startSeconds: 855 endSeconds: 943 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=855' heldReason: rights - ordinal: 15 text: null startSeconds: 855 endSeconds: 943 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=855' heldReason: rights - ordinal: 16 text: null startSeconds: 943 endSeconds: 953 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=943' heldReason: rights - ordinal: 17 text: null startSeconds: 953 endSeconds: 1028 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=953' heldReason: rights - ordinal: 18 text: null startSeconds: 1039 endSeconds: 1127 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=1039' heldReason: rights - ordinal: 19 text: null startSeconds: 1137 endSeconds: 1235 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=1137' heldReason: rights - ordinal: 20 text: null startSeconds: 1245 endSeconds: 1298 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=1245' heldReason: rights - ordinal: 21 text: null startSeconds: 1309 endSeconds: 1469 watch: 'https://liquidgold.cc/watch/BM2JX9hqsVQ?t=1309' heldReason: rights --- # What if the network was the sandbox? — Remy Guercio, Tailscale Standard sandboxing puts the API key inside the sandbox. The agent has the key, which it can exfiltrate, misuse, or — if it runs long enough — find creative ways to leverage beyond its intended scope. Remy Guercio from Tailscale argues that sandboxing conflates two separate problems: execution isolation and access control. You can fully isolate a runtime and still have the agent holding credentials it can abuse. Their answer is Aperture, an LLM gateway built on Tailscale's WireGuard identity network. Every connection carries verified identity — user, tag, or group — and the agent gets a placeholder instead of a real key. There is nothing to exfiltrate. Every LLM call has to pass through the network layer, so Aperture sees every tool call, bash command, and MCP request without instrumentation inside the container. Internally at Tailscale, bash dominates over structured tool calls — and now they can actually see that. Speaker info: - https://www.linkedin.com/in/remyguercio/ Timestamps: 0:00 - Introduction and the concept of a sandbox 1:15 - Breaking down the components of a sandbox (boundary and permissions) 1:52 - How permissions are typically handled (API keys vs. OIDC) 3:18 - Introducing Tailscale and WireGuard for network-level identity 5:42 - Introduction to Aperture (AI Gateway) 7:28 - Live demo: Viewing usage metrics and logs in Aperture 9:47 - Live demo: Inspecting GitHub Actions PR review bot logs 10:39 - Visibility into tool calls, bash commands, and MCP requests 11:46 - Agent setup and configuration in Aperture 13:59 - Advanced features: Cost controls, quotas, and webhooks 15:35 - Using tsnet to build custom internal identity-aware services 17:03 - Q\&A: How to configure permissions (Grants vs. ACLs) 18:46 - Q\&A: Network-layer transparency for base URLs 20:25 - Q\&A: Permissioning based on users vs. model/provider 21:28 - Q\&A: Handling non-tool call agent behaviors (direct code execution) --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/BM2JX9hqsVQ-what-if-the-network-was-the-sandbox Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/what-if-the-network-was-the-sandbox-remy-guercio-ta-ddb075a95738 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.