Azure Container Apps recently underwent a significant upgrade that changed how you'd architect an AI agent on it: Sandboxes, a new isolation model built on microVMs; Express, a stripped-down environment tier designed specifically for agent tool-calling; and integration with Microsoft's open-source Agent Governance Toolkit for policy enforcement.

The upgrade addresses a problem most teams running agents in production encounter sooner or later: what do you do when your agent needs to execute code it didn't write or call out to tools and services you don't fully trust? Sandboxes give you microVM-level isolation with sub-second startup, fast enough to spin one up per request and throw it away. Express drops the parts of Container Apps that agent workloads usually don't need — VNet, GPU, Dapr — in exchange for near-instant cold starts and no idle cost. The Governance Toolkit adds a policy layer on top: tool allowlisting, identity, and the kind of guardrails the platform itself doesn't give you.

The whole talk is built around one small agent, hardened step by step, live. It starts unprotected, and then we drop it into a Sandbox and show what that actually buys you. Then we move its tool-calling layer onto Express and see where that helps and where it breaks. Then we bolt on a policy layer from the Governance Toolkit and watch it block a tool call it shouldn't allow. By the end, you've seen each piece do its actual job on the same system.