Secure AI-generated code from proposal to execution

When an agent proposes a fix to a preprocessing script, an ML team needs more than a plausible patch. It needs to know which source revision the agent inspected, which dependencies executed, what the patch changed, and which evaluation accepted the result.

Polyaxon can organize that path from interactive investigation to a repeatable qualification job. Sandboxes supply a controlled workspace for approved experiments. Components capture the environment and evaluation procedure. Tracking, artifacts, and run comparison retain the evidence a reviewer needs before incorporating the change into a shared ML workflow.

Separate the controller from generated code

Keep the agent application, model credentials, and authorization logic in a trusted process. Use the sandbox client to execute code inside a selected service run. The host binds the owner, project, and run UUID before invoking a tool; these values should not come from generated arguments.

Review the service's effective configuration, including presets and attached connections. Generated code executes with the container's filesystem access, environment, and workload identity. A restricted tool name does not reduce the authority of credentials already present in that container.

Polyaxon's authentication plugin normally injects a context with the user's access within the project's scope. For a worker that does not need authenticated Polyaxon calls, set plugins.auth: false. Review mountArtifactsStore as well, and attach only necessary connections. Keep tracking and durable artifact registration in the trusted controller when the execution worker should not have those capabilities.

Package a repeatable execution environment

Build the Python runtime, required libraries, and evaluation utilities into an approved image. Record its digest with the patch's source and dependency-lock revisions. A package installed interactively during investigation must become part of the versioned environment before qualification.

Use a platform-maintained scheduling preset for resource limits, queue selection, and environment settings. The environment specification exposes serviceAccountName and securityContext; use them with an administrator-approved workload identity and non-root execution configuration.

Configure network policy and runtime isolation for the trust level of the generated code. Polyaxon schedules the container and exposes its process interface; enabling a sandbox does not itself create a separate kernel or guarantee a hostile program cannot escape. A command timeout, an operation lifetime, and an egress policy address different risks.

Bind execution to the reviewed bytes

The following host script checks a local Python file against a digest supplied by a trusted review process, then executes those same bytes in a sandbox. It requires a configured Polyaxon client and an already running disposable service with Python. Set the four sandbox and approval environment values before running it.

The digest records what was approved; it is not a malware detector. The service must already have the intended access and isolation controls. This example returns execution metadata without automatically publishing raw output.

import hashlib
import hmac
import json
import os
from pathlib import Path

from polyaxon.client import SandboxClient

source = Path("candidate.py").read_bytes()
if not source or len(source) > 128 * 1024:
    raise ValueError("Expected a nonempty Python file of at most 128 KiB")

digest = hashlib.sha256(source).hexdigest()
approved_digest = os.environ["APPROVED_CODE_SHA256"].lower()
if not hmac.compare_digest(digest, approved_digest):
    raise PermissionError("Candidate differs from the approved content")

with SandboxClient(
    owner=os.environ["SANDBOX_OWNER"],
    project=os.environ["SANDBOX_PROJECT"],
    run_uuid=os.environ["SANDBOX_RUN_UUID"],
) as sandbox:
    sandbox.ping()
    result = sandbox.process.exec(
        command=["python", "-I", "-"],
        stdin=source,
        workdir="/workspace",
        timeout_ms=30_000,
    )

print(json.dumps({
    "code_sha256": digest,
    "exit_code": result.exit_code,
    "timed_out": result.timed_out,
    "duration_ms": result.duration_ms,
    "stdout_truncated": result.stdout_truncated,
    "stderr_truncated": result.stderr_truncated,
}, indent=2))

The process API accepts an argument list and stdin separately. Here Python's isolated mode reduces interpreter dependence on user configuration; it does not restrict Python's filesystem or network capabilities. Scope approval to the target environment and task as well as the source digest when the same code could have different effects against different data.

Qualify the candidate as a Polyaxon workflow

Create separate job components for checks that need different environments or privileges. For an ML preprocessing patch, a useful workflow prepares sanitized fixtures, analyzes source and dependencies, executes deterministic behavior checks, and generates a comparison report.

Use a DAG to order those operations. Declare artifact inputs explicitly instead of assuming dependent jobs share a filesystem. Give the qualification stages no deployment credentials. A later publication or deployment operation can use a different connection after the required review.

The trusted evaluator should record the original source digest, candidate digest, container image, fixture revision, check version, and individual results. Use tracking.log_inputs() for candidate identity, tracking.log_metrics() for measurable outcomes, and artifact tracking for reports and sanitized patches.

Write report files under tracking.get_outputs_path() before registering artifact references. A file left in a sandbox's scratch directory can disappear with its pod. Persist outputs by downloading the required files and retaining them with the qualification evidence.

Review and promote the measured result

In run comparison, inspect baseline and candidate runs with the same fixture and evaluator revisions. Show behavior-check pass rate, schema changes, runtime, and peak resource observations. Examine case-level differences before accepting a better average.

The release decision should identify the exact patch and qualification run, along with known limitations and the reviewer. If code, dependencies, or the target environment changes, repeat the relevant qualification. After promotion, use the same component and tracked inputs to investigate a regression.

This gives AI-generated changes a normal place in the Polyaxon platform: interactive exploration produces a candidate, reproducible jobs establish its behavior, and retained evidence supports an explicit decision to use it.