How much should a local AI agent be allowed to touch? A write to a read-only folder was refused even after approval

Picture a read-only folder and an AI agent that tries to create a new file in it. A person has already approved the command on the approval screen. The result is still "access denied," exit code 1 ^{1 2}.

That is one scene from a test of MXC on an RTX Spark laptop by AKIBA PC Hotline!'s reviewer (in Japanese). According to the reviewer, even after the command was allowed on the approval screen, the folder permissions on the MXC side still applied ².

An agent on your own machine can read files, write files and reach the network. That is exactly why it helps to decide, up front, how much it may touch. The AKIBA PC Hotline! test holds a worked example of that decision, and the thing the fence did not catch.

The fence the reviewer built

The test machine was a 64GB ASUS ProArt P16 (H7607) running OpenClaw Windows Hub ³. The version was v2026.9.8-1, and because the laptop runs Windows on Arm, the arm64 installer was the one to pick ⁴. Everything below is a result on that machine, that version and those settings.

• GPU memory allocation: set to 40GB in NVIDIA App [[F343]]
• Model: Qwen3.6 35B-A3B, quantized as UD-Q4_K_S, about 21.4GB [[F344]]
• Where things run: both the Gateway that coordinates the work and the LLM were set up inside the ProArt P16, with no cloud LLM [[F347]]
• Confirmation: the Exec Policy default action was set to Ask, so each command's contents are checked and approved before it runs [[F348]]
• What is shut: the Node Sandbox started from Locked Down, with Documents, Downloads and Desktop set to Blocked, the clipboard to None and internet access OFF [[F349]]
• What is open: only the Input folder, read-only, and only the Output folder, read and write. The reviewer notes that the point is to register those 2 folders individually rather than allow the whole parent folder [[F350]]

In short: close everything, then open only the 2 places you need ⁵. Microsoft describes the same idea from its side. According to Microsoft, developers and IT administrators define the files and network destinations an agent may use, and MXC enforces those policies at runtime in the appropriate container ⁶.

Where the fence held

The results came out as configured.

• Trying to create a new file in Input was refused with access denied and failed with exit code 1 [[F351]]
• Running curl through the Windows Node with external traffic blocked failed to resolve the host name, exit code 6 [[F353]]
• A note in Input was summarized and saved as review-summary.md in Output [[F354]]
• With the PC's internet connection switched off, a new summary, offline-summary.md (454 bytes), was still created and saved [[F359]]

On the point that approval did not override the folder rule, Microsoft's design notes are worth a look. Microsoft writes that an agent cannot be its own security authority ⁷. The policy sits outside the agent's control, so the agent or the code it generates cannot grant itself additional access ⁸. Read together with the test result, saying "yes, run it" on an approval screen and the folder permissions turn out to be separate matters ^{2 8}.

The reviewer's conclusion is that three things were set up cleanly: the agent does not alter the original data on its own, does not save elsewhere on its own, and stays local ⁹.

What the fence did not guard

This is the part of the test most worth reading.

When the agent summarized the note in Input, the summary contained errors. The reviewer writes that "specified folder" turned into "specified format," and "unify the power mode" turned into "integrated mode" (a translation of the Japanese examples) ¹⁰. Some errors remained after corrections were requested, and the AI reported that the text matched the original ¹¹.

A person fixed it. The reviewer opened the original and the saved file directly and compared them, then asked for an overwrite while spelling out the exact wording to use, and the file finally came out as specified ¹².

This is not a flaw in the fence. As the reviewer puts it, MXC is a mechanism that controls permissions at run time, not a feature that makes the contents of a summary correct ¹³. The reviewer's summary: the contents of the summary needed human review, but file access rights can be controlled on the execution-environment side ¹⁴.

Put plainly:

• In this test, what the fence (MXC) handled was where the agent could reach and which way things could leave. It protected the original data, stopped stray save locations and cut the network [[F360]] [[F353]].
• What it did not handle was whether the written contents were right [[F358]]. Do not take the agent's own report that "it matches the original" at face value.

The original note sat in the read-only Input folder, and the settings made only Output writable ⁵. And an attempt to create a file in Input was in fact refused ¹. Checking the contents against the original is still a separate job, and it is yours.

Where MXC support stands

According to the Microsoft Windows Developer Blog, MXC is now generally available and provides the containment layer for agents ¹⁵. AKIBA PC Hotline! writes that Microsoft announced general availability of MXC for Windows 11 on October 7, 2026 ¹⁶.

Microsoft names the following support status.

• Already supported: GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI [[F386]]
• Support still to come (planned): Anthropic Claude Code, Hermes Agent and others [[F387]]
• Microsoft writes that NVIDIA has integrated OpenShell into MXC [[F388]]

Planned does not mean usable today. In an earlier announcement, NVIDIA wrote that Hermes Agent and OpenClaw would integrate OpenShell and the Microsoft security primitives into their new Windows applications ¹⁷. In Microsoft's general-availability post, OpenClaw is on the supported side ¹⁸. PC Watch's Shimizu wrote at the time that Hermes did not yet support MXC and was planned for October ¹⁹.

The test used OpenClaw Windows Hub ³. Other agents, or other versions, will not necessarily get the same fence in the same way.

Why the agent can live on your desk: Kasahara's column

In an ITmedia PC USER column (in Japanese), Kasahara explains from the package design and the memory why an RTX Spark machine can host a local agent.

According to Kasahara, RTX Spark puts an NVIDIA GPU die and a MediaTek CPU die on one package ²⁰. With LPDDR5x-9400, memory bandwidth is 300GB per second, against 150GB per second for a typical PC SoC ²¹. On a 128GB machine, according to Kasahara, you can for example give 32GB to the CPU and the rest to the GPU, with the split changed statically in NVIDIA App ²².

NVIDIA writes that RTX Spark's 1 petaflop of AI compute and 128GB of unified memory can meet the demand of on-device agents ²³. NVIDIA also writes that a new resource-management feature in NVIDIA App lets users choose whether the foreground app or the background agent gets more GPU resources ²⁴. The same post, though, opens by listing this among updates "coming soon" ²⁵, and the feature requires hardware-accelerated GPU scheduling to be enabled in Windows Settings ²⁶.

The way in is short, too. According to Kasahara, on RTX Spark Windows 11 the "Welcome" menu lists 3 harnesses, Hermes Agent, OpenClaw and Perplexity, and each installs in 2 to 3 clicks ²⁷. All are distributed through the Microsoft Store and have a Windows GUI ²⁸. Kasahara explains a harness as a way to properly control the unruly AI model and have it do what is needed ²⁹.

A harness is a set of reins, and on a local agent you are the one holding them. The shorter the way in, the more it matters to design the fence first.

The column opens 14 years ago ³⁰. In Kasahara's telling, NVIDIA supplied the Arm SoC Tegra 3 for Windows RT in October 2012 ³⁰. Windows RT, Kasahara writes, was specified so that apps other than the preinstalled Microsoft Office could not be installed ³¹. The column also describes the scene in which Arm's CEO signed one of those first Surface devices and gave it to NVIDIA's Jensen Huang ³², and notes that the Huang subordinate in charge of Tegra back then was that same Arm CEO ³³.

Does it pay for itself? Kasahara's estimate

Kasahara notes that the Copilot services that use frontier AI models are pay-as-you-go ³⁴. That can mean open-ended costs, though cost-management tools can set a ceiling beyond which use stops ³⁵.

Kasahara then writes that for people already running agentic AI in the cloud, moving it local cuts costs ³⁶. The column also gives an estimate. Taking the price Kasahara cites for the top RTX Spark PC model, a user with a sizable monthly pay-as-you-go bill, at the level used in the column, would earn the machine back in under a year by that calculation ³⁷.

That is Kasahara's arithmetic, and the numbers come out differently for someone whose monthly cloud bill is smaller. In terms of the fence, you swap a monthly bill for taking on fence design and content checks yourself.

If you put one on your own desk

Here is what to take from the AKIBA PC Hotline! test.

• Close first: limit what the agent touches to a read-only input and a read-write output, 2 places in all [[F350]]. Do not open the parent folder.
• Cut the network by default: confirm yourself that curl fails with external traffic blocked [[F353]]
• Approval and permissions are separate: the approval screen is a human decision, folder permissions come from the execution environment, and the latter holds after the former [[F352]]
• A person checks the content: whether a summary is right is outside the fence. Do not accept the agent's "it matches" [[F356]] [[F358]]

Local models also mean big files. The reviewer's model was about 21.4GB ³⁸. If you plan to swap several models in and out, spare storage helps.

If you are considering an RTX Spark laptop, check on the official pages that the agent and fence tools you want to run support that machine and OS. Even in Microsoft's list, MXC support splits into already supported and planned ^{18 39}.

You can also look for RTX Spark laptops on Amazon.

Read next

For what other people are trying to hand to agents, see What a pair of writers tried handing to AI agents on RTX Spark laptops. If you are weighing memory capacity, this comparison of reviewers' measurements lines them up.