Is the VM layer mostly for host hygiene, or are you also treating the instances as a real security boundary when something untrusted (deps or agent-written code) runs inside?

For agent workloads, how are you separating "where the code runs" (namespace/gVisor/microVM) from "what credentials and egress ever enter that guest"?