Isolation
Each conversation receives approved workspace mounts and a dedicated home volume in a rootless container. An optional administrator setting can also mount the operator’s home. The network setting expresses intent; it is not an enforced egress firewall.