The Problem: AI Agents Need Guardrails
AI agents are increasingly tasked with more than just answering questions. They write code, interact with external tools, and load plugins. The core challenge isn't initiating these actions, but controlling what the code is allowed to do once it's running. Traditional permission systems address whether code may run, but they fail to answer the critical question of how far it may run. This is the gap Ephemora Cell aims to fill.
Ephemora Cell is a new, open-source execution layer designed to provide fine-grained control over untrusted workloads. It operates as a capability-limited WASI (WebAssembly System Interface) runtime, suitable for agents, MCP tools, plugins, and code interpreters. The goal is to provide a bounded environment where code executes with only the explicitly granted permissions, and all other access is denied by default.
The system is installed via pip with pip install ephemora-cell and is released under the Apache-2.0 license. Its architecture places it beneath existing agent frameworks, acting as a secure intermediary. The guest code, whether an AI agent or a tool it calls, only receives the specific capabilities provisioned by the host. This closed-by-default approach is crucial for mitigating risks associated with running potentially untrusted code.
Capability-Based Security for WASM
The fundamental principle behind Ephemora Cell is capability-based security. Instead of relying on broad, identity-based permissions (like 'user X can access file Y'), capability-based security grants specific, unforgeable tokens (capabilities) that allow access to a particular resource for a limited duration or purpose. In Ephemora Cell, these capabilities are used to control what the WebAssembly (WASM) guest can do.
WASM itself offers a secure execution environment, running code in a sandboxed virtual machine. However, WASI extends WASM's capabilities by allowing it to interact with the host system's resources, such as file systems, networks, and clocks. This is where the need for precise control becomes paramount. Without careful management, a malicious or buggy WASM module could exploit WASI interfaces to gain unauthorized access or perform destructive actions.
Ephemora Cell acts as a gatekeeper for these WASI interactions. When a WASM module requests access to a resource (e.g., reading a file, making a network request), Ephemora Cell intercepts the request. It then checks if the module has been granted the specific capability required for that operation. If the capability exists and is valid, the operation proceeds. If not, it is denied. This is a significant departure from traditional operating system security models that often grant broad access based on user or process identity.
How Ephemora Cell Works
The core of Ephemora Cell is its WASI runtime, which is configured to enforce capability limitations. When an untrusted piece of code is loaded into the sandbox, it is given a set of specific capabilities. These capabilities are not just abstract permissions; they are concrete handles that the WASM module can use to interact with the host. For example, a capability might allow reading a specific file, but not writing to it, or making a network request to a particular IP address and port.
The typical workflow looks like this: An AI agent, acting as the orchestrator, decides to execute a tool or plugin. This tool/plugin is compiled to WASM. Before it runs, it's loaded into Ephemora Cell. The host system, which controls Ephemora Cell, grants the WASM module only the necessary capabilities. For instance, if the tool needs to read a configuration file, the host would grant a capability to read that specific file. If it needs to write to a temporary log, a capability for writing to a designated temporary directory would be provided.
The beauty of this approach lies in its explicitness. Developers can define precisely what each component of their AI system is allowed to do. This is particularly important for AI agents, which often operate with a high degree of autonomy and can be unpredictable. By limiting their operational scope, developers can significantly reduce the attack surface and prevent unintended consequences.
The project's repository on GitHub (https://github.com/MichaelS1011/ephemora-cell) provides the source code for those who wish to examine or contribute to the project. The use of WASM as the execution target is strategic. WASM is designed for safe, sandboxed execution and is gaining traction across various platforms, making it an ideal substrate for building secure, isolated execution environments.