I wrote a technical essay defining execution containment as a structural property for tool-using agents.

The core idea is binding runtime authority to a pre-declared execution graph using cryptographic capability tokens.

It focuses strictly on execution containment, not semantic exfiltration or prompt injection.

Full essay: https://spacecypher.substack.com/p/execution-containment-for-tool-using

Happy to answer questions about scope or limitations.