Imraan Imraan · Vancouver, Canada

I build the infrastructure AI agents run on, and the guardrails that make them safe to ship.

I'm Imraan, a senior engineer working on durable agent loops, sandboxed execution, and tool policy and human approval enforced outside the model. That sits on 12+ years of Go, Python and TypeScript backends.

See what I'm building Get in touch
agentTaskWorkflow · run 7f3a

task "Find Friday's invoice and send it to Sam"

01 gmail.search allow
02 workspace.python allow
03 browser.open allow
04 gmail.send needs_approval

⏸ waiting for your approval

to: sam@… · 1 attachment · sha256 9f3c…a71e

✓ approved · ran once · 4 decisions / 20 budget

Current work

Agents that propose. Policy and people approve.

Two systems I'm building right now. Both are private repos, and I'm glad to walk through the code, the ADRs and live runs on a call.

Super Agent

Now building

A personal agent that runs durably and asks before it acts.

You give it a task. It plans with a model, works in a private cloud sandbox with Python, files and a real browser, reads your connected accounts, and stops for your exact approval before anything leaves them. Each run is a Temporal workflow, so it survives crashes, deploys and restarts.

  1. Chat UI →
  2. API + outbox →
  3. Temporal workflow →
  4. Model decision →
  5. Policy gate →
  6. Sandbox · browser · connectors

Bounded, durable agent loop

Each run is capped at 20 decisions, 30 tool calls and 15 active minutes. Long histories roll over with continue-as-new, and payloads carry IDs only. Runs replay correctly after worker and server restarts.

Tools never run on their own

The model can only propose typed tool calls. A policy engine rules on every proposal: allow, deny or needs_approval. Any external write always waits for a human.

Exact-approval hashing

Each approval is a sha256 of canonical JSON covering the account, arguments, destination, attachment hashes, nonce and expiry. The approved action runs at most once, and an unknown outcome is never resent.

Sandboxed workspace and browser

Python and files run in E2B microVMs, and Chrome is driven with Playwright over CDP. Browsing is limited to allowlisted domains, with SSRF and DNS-rebinding checks. Untrusted content is fenced off from instructions.

UI inside the chat

A live run trace shows every step, and question and approval cards appear right in the conversation. A mission rail tracks long-running work, and you connect apps through Composio OAuth.

Built to be operated

A transactional outbox (SKIP LOCKED) feeds Temporal, a reconciler keeps projections honest, a sweeper cleans up orphaned sandboxes, logs are redacted, and model calls go through a Gateway allowlist.

150
tests, incl. 17 on a real Temporal server
7
architecture decision records
9
connectors (Gmail, Slack, GitHub, …)
30k
lines of TypeScript
  • TypeScript
  • Temporal
  • AI SDK
  • Vercel AI Gateway
  • Claude
  • E2B
  • Playwright
  • Composio
  • Next.js
  • Hono
  • Postgres
  • Drizzle
  • S3

Agent Box

Infra for the fleet

One command turns a bare VM into an unattended coding-agent fleet.

Agent Box is infrastructure as code for a server that runs Claude Code, Codex, opencode and aider across many repos in parallel git worktrees. It's the machine that builds Super Agent: agents plan, write and review each other's PRs, and the guardrails are enforced outside the model.

  1. Planner →
  2. Issue queue →
  3. Workers in worktrees →
  4. Cross-model review →
  5. Risk gate →
  6. Merge or human

Multi-agent loop with a cross-model reviewer

A planner opens small issues and workers take allowlisted ones. A reviewer running a different model gates every PR. Low-risk changes auto-merge, risky paths go to a human, and fix rounds are capped.

Locked-down execution

Every run happens in its own Docker container with memory, CPU and PID limits and no-new-privileges, with only its worktree mounted. Agents run as an unprivileged user with no sudo and no Docker access.

Guardrails the model can't talk past

A root-owned pre-tool-call hook blocks secret paths, force pushes, sudo and curl|sh, and a system git hook blocks pushes to main. Workers use a separate token, so they can't approve their own PRs, and reviewer verdicts are parsed so a PR can't inject one.

Reproducible from zero

OpenTofu provisions an ARM VM, Ansible hardens it (nftables, fail2ban, earlyoom), and an idempotent deploy finishes with verify. There's a local OrbStack rehearsal, plus a runbook an agent can follow to deploy the box itself.

Cost and kill switches

Every run's cost lands in a ledger, with a daily USD budget cap. One command stops the whole fleet, and a daily summary goes to my phone.

4
agent CLIs supported
1
command from bare VM to fleet
0
sudo, Docker or main-branch access for agents
  • Bash
  • Docker
  • OpenTofu
  • Ansible
  • Oracle Cloud (ARM)
  • systemd
  • GitHub API
  • Claude Code
  • Codex

Also shipped

Search Tabs, a privacy-first Safari extension for searching open and recently closed tabs. It's on the Mac App Store.

App Store ↗ GitHub ↗

Focus

What I work on

The unglamorous layer between a model and a real user: the runtime, the sandbox, the policy and the interface that make agents something you can run and trust.

Agent runtime & orchestration

Durable loops on Temporal with step, tool and time budgets, continue-as-new, idempotent IDs and replay-safe activities. Multi-agent pipelines with planners, workers and reviewers.

Super Agent · Agent Box

Sandboxing & agent security

Isolated execution in microVMs and containers, least-privilege tokens, SSRF and DNS-rebinding defenses, prompt-injection boundaries, and hooks that hold up even in bypass mode.

E2B · Docker · policy engine

Tools, connectors & approvals

Typed tool contracts, per-class policy, OAuth connectors, and approvals bound by exact hash so an action runs once and only as approved.

9 connectors · ADR 0005

Agent UX

Interfaces people can supervise: live run traces, question and approval cards inside the chat, and status for long-running missions.

Next.js · React 19

Reliability, cost & observability

Integration tests on real infrastructure (forged signals, restarts), redacted structured logs, OpenTelemetry, per-run cost ledgers and budget caps.

150 tests · OTel

AI-native engineering

Repos built for agents to work in: a CLAUDE.md per package, project skills, lint-enforced boundaries, and runbooks an agent can follow. I ship daily with Claude Code and Codex.

Claude Code · Codex

Agents

Claude · AI SDK · AI Gateway · Composio · E2B · Playwright · Claude Code · Codex

Languages

TypeScript · Go · Python · Bash

Platform

Temporal · Postgres · Redis · Docker · Kubernetes · OpenTelemetry

Cloud & IaC

AWS · GCP · Oracle Cloud · Cloudflare · OpenTofu · Ansible · ArgoCD

Contact

Building agents people can trust?

I like talking shop about agent runtimes, sandboxing and approval flows. If you're working on similar problems, or want a live tour of Super Agent and Agent Box, send a note.

[email protected] github.com/imraan-go linkedin.com/in/al-imraan
© 2026 Imraan · Vancouver, Canada Built with Astro · deployed on Cloudflare