What if the network was the sandbox? — Remy Guercio, Tailscale

TL;DR

• 1

  The network can be the sandbox: Guercio reduces a sandbox to two essentials, a boundary and permissions, then asks what happens if authN and authZ live at the network layer instead of inside a VM or container.

• 2

  API keys are the weak point: He says today's common patterns, raw provider keys or OAuth inside the sandbox, still hand the agent the thing that grants access, which means it can be exfiltrated or misused.

• 3

  Aperture replaces per-agent keys with Tailscale identity: Built on WireGuard and Tailscale tags, groups, and users, the gateway takes one upstream key for providers like OpenAI, Anthropic, Gemini, Vertex, and Bedrock while sandboxed agents connect with no usable key of their own.

• 4

  Every request becomes attributable and inspectable: In the demo, Guercio shows per-user and per-bot logs with token counts, model usage, request and response bodies, costs, and even extracted bash and MCP tool calls from a PR review bot.

• 5

  The control point is harder for agents to route around: Because enforcement happens at the network layer, shutting off access is not a matter of revoking a leaked key, it is simply a denied connection, which removes the agent's chance to try another endpoint with the same credential.

• 6

  This is meant to be built on, not just bought: Guercio says the same Tailscale identity primitives are available through the open source tsnet library, so teams can build internal MCP servers or APIs with tailnet-native identity and policy, plus JSON, API, and GitOps-friendly permissioning.