Sep 27, 2026 The Closed Track: Shrinking an AI Agent's Blast Radius Part 4 A code-running agent tool inherits its pod's blast radius. NetworkPolicy, a dropped ServiceAccount token and gVisor shrink it — and a blast-radius report shows which layers actually hold. agentic-aizero-trustnetworkpolicygvisor