A sandbox is a bounded execution environment where the agent's actions are scoped to a defined set of resources.
The sandbox is the agent's blast radius. Without a sandbox, an agent that misbehaves (or that is compromised) can do anything the underlying system can do. With a sandbox, the agent can only do what the sandbox allows. The sandbox is the right place to put the limits on what the agent can touch.
What a sandbox scopes
A sandbox typically scopes:
1. File system. The agent can read and write only within a defined directory tree. The sandbox enforces the directory boundary at the kernel level, not at the application level.
2. Network. The agent can make outbound network requests only to a defined allowlist of hosts. The sandbox enforces the host allowlist at the network level, not at the application level.
3. Processes. The agent can spawn only a defined set of binaries with a defined set of arguments. The sandbox enforces the binary allowlist at the process level, not at the application level.
4. Environment. The agent can read only a defined set of environment variables. The sandbox enforces the environment allowlist at the process level, not at the application level.
5. Resources. The agent is bounded by a defined set of resource limits (CPU, memory, disk, time). The sandbox enforces the resource limits at the kernel level, not at the application level.
Why sandboxes matter
Sandboxes are the right place to put the security boundary because sandboxes are the last line of defense. Every other layer of the agent's safety (the model's alignment, the prompts, the HITL approvals) can fail; the sandbox is the layer that catches the failure. The sandbox is also the right place to put the observability boundary because the sandbox is the layer that records what the agent did.
The right defaults
The right default for a new agent system is the most restrictive sandbox that the system can still operate in. The sandbox is then relaxed as the operator adds capabilities and as the operator verifies that the relaxation is safe. The wrong default is the most permissive sandbox (full system access), and the wrong default is the one that gets deployed.
Operator implications
The sandbox is the right place to start when an operator is hardening an agent that is going to be exposed to untrusted input. The most common operator issues with sandboxes are: the sandbox is too permissive (the agent has more access than it needs), the sandbox is too restrictive (the agent cannot do its job), the sandbox is not enforced (the application-level checks are bypassed), and the sandbox is not tested (the operator has not verified that the sandbox actually catches the failure modes).
Related terms
The sandbox is the layer that enforces the agent loop's resource limits. The sandbox is the layer that the tool sits within. The sandbox is the layer that the MCP server's resources are exposed through. The sandbox is the layer that the session is scoped to.
For the full primer, see Evaluation, Safety, and Governance for AI Agents.