Brig is a micro VM sandbox tool that isolates code execution by limiting guest access to specific host directories, credentials, and network resources. The guest can only reach its home, named projects, delivered credentials, and internet; it cannot access keychains, SSH agents, or secret managers. Brig uses microVMs on both macOS and Linux for stronger isolation than plain containers.