Microsoft Execution Containers: Policy-driven containment for AI agents — Blankdot