The Hypervisor Metaphor: Why Google Treats AI Agents Like Virtual Machines
Scion’s most distinctive architectural decision is treating agents the way hypervisors treat virtual machines — each agent runs in its own container with separated credentials, configuration, and a dedicated git worktree. Google describes one of Scion’s basic tenets as "preferring isolation over constraints to make agents operation safe." This means agents can run in unrestricted (--yolo) mode within their containers, free to execute any action without confirmation prompts, because the blast radius is bounded by the container boundary itself.
This is a fundamentally different philosophy from most multi-agent frameworks, which tend to impose safety through code-level constraints, permission systems, or human-in-the-loop approval chains. Scion’s approach borrows from decades of infrastructure wisdom: rather than making the software safe, make the environment safe and let the software run freely. The integration of memory, chatrooms, and task management as "orthogonal concerns" further reinforces this — Scion is less a framework and more an operating environment, with each capability plugged in as a separable service rather than baked into an opinionated runtime.
