Why every tool runs in a sandbox
An agent that can run a shell is useful exactly as long as it cannot hurt you. Here is how Nova contains itself.
Nova does real work: shell commands, file edits, web searches, a live browser. That is the point. It is also the risk. An agent with broad capability and no walls is an incident waiting for a prompt.
So the walls came first.
One subprocess per session
Every session’s tools run in an isolated subprocess. When the session ends, the whole process group is reaped. Nothing lingers, and nothing leaks between sessions.
This is also what makes orchestration safe. When a session flips into coordinator mode and spins up worker subprocesses for parallel work, each worker inherits the same walls. The blast radius of a bad run is one process group, and that group dies with the run.
The model never sees a secret
API tokens and OAuth credentials live in separate tool processes. The model receives results only. It cannot print a key it never held, and it cannot be talked into handing one over.
The same rule covers Google Workspace. Nova drafts and triages Gmail, schedules calendar events and handles Drive files across multiple accounts, but the credentials for those accounts sit inside an isolated process and never enter the model’s context. Access flows through scoped, rotatable OAuth. No long-lived API key sits in the runtime waiting to be found.
File access resolves through realpath and a deny-list of sensitive paths. Symlink tricks do not work. Keys, .env files, and credential stores stay out of reach.
No public listener
Health and webhook servers bind to loopback only. The optional desktop API is reachable over a private Tailscale network and nowhere else. There is no 0.0.0.0 to misconfigure.
Internal tool servers require independently rotatable bearer tokens, and every request body is size-capped. Inbound webhooks are HMAC-verified and rate-limited per hook before any agent run begins. Nothing from the outside gets to start work without proving who it is.
Everything is written down
Every tool call, job run, and error goes into an append-only log with inputs, outputs, and duration. Nothing is silently deleted. When you ask what Nova did, the answer is a record, not a recollection. It is also what makes governance review possible: every model action is traced, so an auditor reads a log instead of trusting a summary.
“Nova runs autonomously with broad capability, so it is engineered to contain blast radius, isolate credentials, and prove what it did.”
A stop you control
If you ever need a hard stop, a configurable kill phrase shuts Nova down immediately and alerts ops. Deploys are drain-safe in the other direction: in-flight turns finish before any restart, with a hard-kill backstop so a stuck run cannot hold the system hostage. Health checks reflect real liveness, meaning channel connections, the database and a warm runtime, not just config flags.
Autonomy you can end in one sentence is autonomy you can live with.