Thanks for the lesson on what each of those technologies is: are you claiming they cannot be used to achieve the effect of disallowing access to a filesystem ar

Thanks for the lesson on what each of those technologies is: are you claiming they cannot be used to achieve the effect of disallowing access to a filesystem area for a process (like an agent)? They have different default behavior (and levels of isolation), which is why I mentioned a few popular choices, but there is more (LXD and Incus, for instance). As far as "following any form of rigour", that's exactly what's happening for many with a move to coding agents — one-shotted diffs are so big, that people cannot keep the focus and introducing a tiny one-liner (eg. one that copied your AWS secret to innocent-file.sig) would likely go unnoticed. So yes, even if you used a VCS and glanced over your dry run IaC output, you'd easily be fooled. Caring about reducing impact of human "mistakes" (due to lack of attention), we also call that defense in depth.