The problem with local agents
Teams increasingly install agent frameworks and CLI agents directly on work machines. It feels convenient — but a workstation agent inherits everything the workstation has: SSH keys, saved browser sessions, password-manager unlocks, cloud CLI credentials, the VPN into your network, and every file on disk.
One prompt-injected document, one malicious dependency, or one over-eager automation and the blast radius is not a task — it is the operator's entire identity and, through it, the organization. Security teams cannot audit what such an agent read, and revoking its reach means rotating everything the person had.
The Box model: contained by construction
A dpanel Box is a dedicated, isolated runtime provisioned per workspace — not a process on anyone's laptop. The AI team executes inside the Box and holds exactly the credentials the operator placed in that Box's encrypted vault: nothing inherited, nothing ambient.
The control plane (the panel you log into) is separate from the execution runtime. Your grounding documents, connections, and secrets live with the Box; the panel orchestrates, gates, and audits. Every action the team proposes is visible on the workflow board, and external actions stop at human approval gates before anything leaves.
Revocation and rotation are one click, not an incident
Because credentials are vault entries scoped to a Box, rotating a key is editing one vault variable, and revoking an entire AI team's reach is stopping one Box. Compare that to hunting down what a workstation agent may have cached.
Server-side guardrails add a second layer that no local setup has: budget caps, model and provider allow-lists, prompt-injection detection, and sensitive-info redaction are enforced before each model call — as platform policy, not as instructions an agent is trusted to remember.
The one-paragraph version for a CTO
dpanel moves AI-agent execution off employee machines into isolated per-workspace runtimes with scoped encrypted credentials, human approval gates before external actions, server-side guardrails on every model call, and a grounding ledger that makes every piece of AI work auditable. The blast radius of a misbehaving agent shrinks from "the operator's entire access" to "one Box you can stop."
For founders and teams protective of unreleased ideas: your grounding documents and workspace data stay scoped to your Box and vault, are never shared across customers, and are not used to train models. The same isolation that protects an enterprise protects a one-person company.
Next step
Turn this concept into a visible workflow with teams, approvals, grounding, and handoff.
See deployment paths