Secure Agent Fleets
Run a growing agent fleet with less standing infrastructure and clear control over access, tools and execution.
The security problem with agent fleets starts with arithmetic. Give every agent its own operating system and a thousand agents become a thousand machines to patch, isolate and monitor. Most spend much of their time waiting for a reply.
Lightspeed separates the agent’s memory and decision loop from the machines it uses. Sessions run as durable workflows on shared infrastructure, borrowing compute when a task needs it. A growing fleet can therefore stay available without a matching fleet of running hosts.
That reduces the infrastructure to defend. The next question is how to control the work those agents are allowed to do.
Keep teams and access separate
Lightspeed groups resources into universes: separate spaces for teams, clients or business units. Sessions, files, credentials and execution environments belong to that boundary. A shared deployment can serve several universes; separate deployments provide a stronger infrastructure boundary when required.
Teams can connect company SSO and assign roles for the universes people use. Some can run existing agents, others can configure tools and machines, and administrators manage membership. Integrations receive API keys scoped to the operations they need.
Give each agent the access its task needs
A profile defines the agent’s tools and resources. A reviewer can read a workspace while a builder can edit it. An investigation agent can inspect a machine while a deployment agent can run commands. These permissions are checked by the tools themselves.
Credentials are stored encrypted and supplied where work executes, so they do not have to be written into prompts or tool arguments. Execution environments use scoped credentials and network access appropriate to their job.
Choose where work happens
Agents can work through APIs and persistent virtual files without a machine attached. When they need a shell or compiler, attach an approved environment: an existing host or a VM provisioned through Lightspeed’s Incus provider.
That makes execution placement an explicit choice. Separate machines can keep unrelated work apart, and idle policies can pause or stop supported VMs. Model connections are configurable too, including compatible endpoints hosted inside your own perimeter.
Keep delegation under control
An agent can delegate only to allowed profiles, with limits on the size, concurrency and duration of its delegation tree. A planner might be allowed to start builders and reviewers without being able to create an unrestricted agent.
The session history records requests, tool calls and results, giving operators a way to follow the work afterwards. Combined with access controls and deliberate execution boundaries, this makes a fleet something an enterprise can operate and review as it grows.
Read next: Govern Long-Running Agents and Continuous Compliance & Audit. For configuration and security boundaries, see the access and security documentation.