A hard boundary around where the agent runs, enforced by the operating system or hypervisor rather than by anyone's judgment. The logic is subtraction: a credential never mounted inside the boundary cannot be read by any injection, because the target is absent. Build it from battle-tested primitives; the weakest layer is the one you built yourself (Chapters 17 and 20).