How do you handle the placeholder to real credential swap on the network side, is the isolated VM's egress forced through the gateway as a transparent proxy, or does the agent have to make an explicit call back to the gateway for each action?
Asking because that decision changes your failure mode a lot. If egress is forced through the gateway, a slow or down gateway just breaks connectivity and the agent fails closed by construction, which is a nice property. If the agent calls back explicitly, you're relying on the agent to actually make that call correctly every time, and now you need to check that no tool has a code path that reaches the real network directly and bypasses the swap.
Asking because that decision changes your failure mode a lot. If egress is forced through the gateway, a slow or down gateway just breaks connectivity and the agent fails closed by construction, which is a nice property. If the agent calls back explicitly, you're relying on the agent to actually make that call correctly every time, and now you need to check that no tool has a code path that reaches the real network directly and bypasses the swap.