AI Agent Workspace Isolation: Start With a Drive Letter

Description and use

On Windows, isolating an AI agent workspace can start with a drive letter instead of Docker. Map a folder to a drive letter using subst, point the agent at that drive, and you have basic isolation. No subscription needed.

Problem

How to isolate an AI agent workspace on Windows without Docker, using a drive letter as the simplest first step.

Outcome

A simple one-time setup using a drive letter isolates an AI agent workspace on Windows, preventing the agent from accessing anything outside the mapped drive. No subscription required.

Workflow

• Map a folder to a drive: use subst for local folders (subst.scsoi.com) or WebDAV/cloud (drive.scsoi.com).
• Point your agent at that drive so it sees one drive and cannot see anything else.
• Upgrade when needed: use Docker or VMs for network isolation, Linux environments, or untrusted code execution.
• For stopping the agent from deleting files, a drive letter is sufficient.

Evidence

Local folder: subst.scsoi.com

Source

WebDAV/cloud: drive.scsoi.com

Source

Thats it. The agent sees one drive. It cannot see anything else.

Source

For 'stop the agent from deleting my files,' a drive letter is enough.

Source