Architecting an AI Agent Platform within an Existing Cloud Storage Ecosystem
This article details Dropbox's approach to integrating an AI agent capable of acting on user files, evolving from side projects into a core product feature. It covers the architectural decisions for providing a secure, controlled, and observable environment for AI agents, leveraging existing infrastructure components like content processing platforms and versioning systems. Key aspects include isolated workspaces, permission enforcement, and structured communication protocols for agent-user interaction.
Read original on Dropbox TechDropbox engineered an AI agent platform to allow users to interact with their files using natural language, enabling tasks like organizing, renaming, and preparing documents. The core challenge was to integrate AI agents securely and controllably into an existing file storage system without compromising data integrity or user privacy. This involved creating isolated execution environments for agents while providing them access to user files and ensuring all actions are auditable and reversible.
Isolated Workspaces and File Access
To enable agents to run external software and operate on files, Dropbox adopted a strategy of isolated computing environments, or sandboxes, based on Ubuntu Linux VMs. These workspaces are ephemeral, spun up for each agent conversation, ensuring a clean state and preventing cross-contamination. File access within these sandboxes is mediated by `rclone`, a tool that mounts Dropbox filesystems into the isolated environment, making them appear as local files to the agent.
Leveraging Existing Infrastructure
Instead of building a new VM provisioning system, Dropbox repurposed its existing `Riviera` content-processing platform. `Riviera` already used QEMU to quickly launch VMs from snapshots for tasks like generating document previews. This accelerated the development of agent workspaces, allowing them to come online in tens of milliseconds by restoring a prepared machine from a memory snapshot.
Security and Control Mechanisms
- Trusted Host Layer: All agent requests to external services (including file system operations) are routed through a `host_tools` process outside the VM. This layer enforces permissions, checks destinations, and adds necessary service credentials, preventing agents from self-granting broader access.
- Explicit User Permissions: Agents cannot directly change files. They must explicitly request folder access via a 'folder-access tool', triggering an 'Allow/Deny' prompt for the user.
- No General Internet Access: Workspaces have no direct internet access; all external communication is proxied and subject to `host_tools` scrutiny.
- Version History & Rollback: By integrating with Dropbox's existing version history capabilities, all agent-made changes are recorded and can be reviewed and undone by the user, providing a critical safety net.
Agent-User Interaction and Observability
To make agent actions transparent and controllable, Dropbox designed a structured communication protocol using JSONL messages via the `Codex App Server API`. This protocol organizes conversations into 'threads', 'turns', and 'items', allowing the UI to display agent progress, proposed plans, and file changes clearly. Users can follow along, interrupt, or refine agent actions, and even approve multi-step plans before execution begins. An adapter pattern allows integrating different AI agent harnesses while maintaining a consistent user interface and inheriting core permission controls.