Core concepts#

Three ideas carry most of the platform. Read them in order and the rest of the documentation follows.

How Lens Agents works

The architecture, the surfaces the platform serves, and what happens to a single agent request on its way out.
Sandbox isolation

Unprivileged execution, kernel-level network lockdown, proxy-mediated egress, and the runtime class that adds a per-sandbox kernel.
Identity

Users, API tokens, and sandboxes as separate principals, and the org, team, and project hierarchy they act within.

The short version#

An agent runs in a sandbox: an unprivileged process whose only reachable network destination is a proxy it does not control.

That proxy enforces a policy — which domains, which HTTP methods and paths, which tools, which model provider. Default is deny.

Credentials the agent needs are injected at the boundary. The agent holds placeholders and never sees a real secret.

The agent is its own principal, so what it did is attributable to it and not to whoever launched it.

Everything above is written to an audit trail, allowed and denied alike.