Software engineering
Safe execution of agent-written code
Let an agent run what it wrote without risk to anything else.
- VM
- Store
- Utilities
The scenario
A coding agent writes a script and needs to test it. It runs in an isolated sandbox that disappears afterwards.
How it works
- 1The agent submits code to a sandbox.
- 2Output and files come back.
- 3Results are stored; the sandbox is discarded.
An illustrative scenario, not a customer story.
Interactive simulation
Simulate this case study
Watch the partition come up, each step run, and usage build as it goes. Simulated: volumes, timings and prices are illustrative.
Partition
—
Status
not created
Elapsed
00:00
- Provisioning
- Processing
- Complete
01The agent submits code to a sandbox.
queued- Ahura VMvm.runqueued
status: queued · 0 / 24 sandbox runs
02Output and files come back.
queued- Ahura Storestore.getqueued
status: queued · 0 / 48 objects stored
03Results are stored; the sandbox is discarded.
queued- Ahura Utilitiesutilities.data_anonymizer_piiqueued
status: queued · 0 / 120 documents processed
Services in this partition
VM
0 calls · 0.00 ACU
Store
0 calls · 0.00 ACU
Utilities
0 calls · 0.00 ACU
Spend by service
Event log
- Waiting to start.
Why Ahura OS
Why this is better on Ahura OS
Letting an agent run code is the riskiest thing most teams do, usually on a machine that holds far more than it should. Ahura OS gives every run its own micro VM that starts in moments and is discarded afterwards, billed by the millisecond. Output and files return to your partition and the sandbox ceases to exist, so nothing leaks between runs and nothing sits idle to be patched. It is the safe default for agent-written code rather than a security project you have to build.
What each capability replaces
- Ahura VMInstead of fleets of machines to patch, every run gets its own disposable sandbox, billed only while it executes.
- Ahura StoreInstead of managing buckets, permissions and lifecycle rules, objects follow the partition: they freeze, thaw and expire with it.
- Ahura UtilitiesInstead of a function platform to host, common helpers are ready to call and billed per invocation.
And on every use case
One endpoint, not a stack
Memory, storage, compute, inference, identity and messaging share one connection, one identity and one bill. The integration work you would normally own disappears.
Isolation by construction
Every agent’s world is a partition. Separation is how the platform is built, not a convention teams must remember to follow.
Cost follows use
Pay per call and per millisecond. Idle agents freeze to archive pricing. There is no capacity to reserve and nothing running unseen.
Retention and deletion built in
Lifetimes, expiry, freezing and destruction are platform features, so your data policy is enforced rather than aspirational.
Safe autonomy
Spending limits, protected signing keys, approval steps and signed actions let agents work unattended without being unaccountable.
Ready for audit
Designed against SOC 2 and ISO 27001 controls, with every call metered, recorded and attributable.
Compared
The old way of doing things
Running generated code on a developer machine or a shared build box, with all the access that implies, or standing up and cleaning VMs by hand.
Data retention is built in
Everything this scenario stores lives in one isolated partition with a lifetime you set. Expired data deletes itself, a paused project freezes to low-cost archive, and a finished one can be destroyed completely. Security and compliance
Industries this applies to
More: all use cases, for researchers, for developers, pricing.

