Nono enforces AI agent isolation at the kernel with seccomp and LSM

Nono moves AI agent security boundaries from the application layer down to the OS kernel. Each tool invocation runs in an ephemeral micro-sandbox with seccomp-bpf syscall filtering, LSM hooks, and phantom tokens instead of real credentials.

• Every tool invocation gets a fresh, capability-bounded micro-sandbox
• Real secrets stay with the supervisor; agents receive phantom tokens
• Isolation relies on seccomp-bpf, LSM hooks, and namespaces
• Overhead is 100–500μs per tool invocation