Play · Developers and platform teams
Pick where each agent runs
You choose where each agent runs,and the governance stays the same.
Agents start on shared workers; moving one to its own container is a manifest change plus a push. Policies evaluate, spans are written, costs attribute and the audit trail is complete at every tier, so the choice is only about isolation, dependencies and cost.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
Who
A platform team with a document-intake agent that needs a PDF parser the platform image doesn't carry, and an insurance workload a CISO wants proved isolated.
What happened
Security asked whether two tenants' runs ever share a worker, and engineering asked for antiword and pypdf in the same week.
What's at stake
Shared workers that can be made safe but not proved safe to an auditor, an agent blocked on a library the image lacks, and compute decisions nobody can trace on an invoice.
- 01Run
Shared by default. A warm slot when you need to prove isolation.
Shared workers are the pooled fleet: no cold start, lowest cost, billed at 1.0×, and the right answer for most agents most of the time. A warm slot moves each execution onto its own Fargate task with STS-tagged credentials scoped to your tenant and minted per run, a per-cell KMS encryption context where a wrong-tenant decrypt is denied by KMS itself and recorded as an auditable event, and no cross-run reuse. Your tenant's sensitivity tier sets the floor: standard routes to shared workers, sensitive makes a warm slot the minimum, and regulated adds an always-on pool with no scale-to-zero. A dedicated cluster reserves slots for a monthly fee and drops per-run compute to 0.7×.
shared 1.0× · warm slot 1.0× (0.7× reserved) · sensitivity: standard / sensitive / regulated · STS-tagged credentials per run · per-cell KMS encryption context
runtime · deployed agents
- 02Run
Bring your own dependencies. The platform builds the container.
Declare dependencies with apt and pip packages and a python version, set execution to mode: isolated and tier: ephemeral, and on wax push Waxell builds an image layered on the governed runtime base, registers it, and routes that agent's runs to it. Each run launches a fresh task and exits, with no idle cost and a flat 1.5× multiplier that covers the cold start, which is roughly 30 to 60 seconds before the agent's own work: fine for document pipelines, noticeable for anything a person is watching, so use a warm slot where latency matters. Rebuilds happen automatically when dependencies change, and a failed build does not break the agent; it keeps running on the shared tier until the build succeeds. With source and entrypoint set, the same container runs your own LangGraph, pydantic_ai or CrewAI code, with ANTHROPIC_BASE_URL pointed at the run's proxy so model calls are governed and your real key is never in the container.
dependencies: apt / pip / python · execution: mode: isolated, tier: ephemeral · 1.5× · roughly 30 to 60 s cold start · wax agents builds <name> · source + entrypoint
waxell.yaml · isolated tieragents: - name: intake dependencies: apt: [antiword] pip: [pypdf>=4.0, python-docx>=1.1] python: "3.11" execution: mode: isolated tier: ephemeral$ wax push$ wax agents builds intake# image built on the governed base, runs routed to it.# a failed build keeps the agent on the shared tier. - 03Run
The honest constraints.
Limits are enforced at the start of every run, and every denial is a structured error with a detail sentence: trial_budget_exhausted, trial_concurrency_limit, feature_not_available, compute_quota_exhausted. The runtime trial is 10 CPU-hours and 20 GB-hours over 30 days, 2 concurrent runs (4 after adding a card), a 15-minute wall-clock cap per run, and the shared runtime only; an agent that declares dependencies or execution: isolated is accepted by wax push but its image build is parked until the workspace is on a paid plan. The Runtime add-on on Team is $99 a month for 100 CPU-hours and the shared tier; Business includes 100 CPU-hours with shared, warm and isolated; Enterprise compute is custom, with every tier plus reserved. On paid plans timeout_seconds in waxell.yaml goes up to 3600. Self-contained agents launch one task per run, so stagger a very large backfill.
trial: 10 CPU-hours · 20 GB-hours · 30 days · 2 concurrent · 15 min per run · shared only · Team add-on $99/mo · timeout_seconds up to 3600
structured denials# checked at the start of every runtrial_budget_exhaustedtrial_concurrency_limitfeature_not_availablecompute_quota_exhausted# runtime trial, 30 dayscpu_hours: 10gb_hours: 20concurrent_runs: 2 # 4 with a card on filewall_clock_per_run: 15mtier: shared# paid planstimeout_seconds: 3600 # maximum in waxell.yaml - 04Prove
Every run records where it ran, and the invoice traces back to it.
Open any run under Observe, Runs, and the Ran on field in the header shows the disposition: shared runtime, reserved capacity, or isolated container. Compute lines under Billing, Usage carry the disposition as event_driven, dedicated_cluster or ephemeral along with the multiplier applied, so the rate on your invoice traces back to where the run executed. For a self-contained agent, the Build panel on the agent shows the build status, the image and which dependencies were installed. If a warm pool is emptied by burst traffic, runs fall back to shared workers with a logged warning; if slot credentials fail to refresh, the run fails cleanly with claim_failed; a wrong-tenant decrypt stops the run and is raised as a security incident, never a silent retry.
Ran on: shared runtime · reserved capacity · isolated container · event_driven / dedicated_cluster / ephemeral · claim_failed · security incident, never a silent retry
observe · executions
- ran on · isolated container · pypdf, python-docx, antiworddoc_intake · run 5120 · ephemeral · 1.5× · cold start before first stepallow
- ran on · warm slot · STS credentials minted per runclaims_triage · run 5133 · sensitivity: sensitive · warm slot minimumallow
- KMS decrypt · wrong-tenant encryption contextclaims_triage · run 5140 · denied by KMS · security incident raised · no retryblock
- image builddoc_intake · build 7 · trial workspace · trial_tier · build parked · runs on the shared runtimehold
Illustrative entries in the shape the product writes them.
Products in this play
No. Agents start on shared workers. Moving one to its own container is a dependencies block and an execution block in waxell.yaml plus a push; moving a whole tenant to warm slots is the sensitivity setting. A failed build leaves the agent running on the shared tier.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF