Google’s open AX runtime declares Task/Workspace/Model manifests on Agent Substrate: sandboxed agent jobs with git/MCP/skills pre-wired, suspend/resume, and ax ssh—aimed at high-throughput cluster runs of autonomous agents, not one laptop session.
PATH-fronted proxies for terraform/aws/kubectl: TOML policies allow plan/read but block destroy/terminate/recursive deletes before the real binary runs—no LLM judgment in the safety path.