Agent execution sandbox
Agent securityagent sandbox · sandboxed agent execution · isolated agent runtime
A bounded environment where an agent executes actions under explicit limits on filesystem, network, credentials and tooling. Not a promise in the prompt — a boundary the agent cannot cross even when asked to, even when it's wrong, even when someone has injected instructions into it.
The sandbox is where agent governance stops being paperwork. An agent can have a beautiful written policy and still read a credentials file. The sandbox is what makes that impossible. The parameters that matter are concrete: whether the sandbox is on at all, filesystem access, network and proxy access, developer-tool access, and OS keychain access. In September 2026 GitHub put centrally managed sandbox policies for Copilot in JetBrains IDEs into public preview with exactly those controls — and one decisive property: managed restrictions take precedence over user settings, and the affected controls are locked in the IDE. That property — the organisation's policy wins — is what separates a real sandbox from a recommendation. A sandbox the user can switch off when it's inconvenient isn't a control. It's a suggestion.
How it differs from
- Per-action human approval
- Approval depends on someone actually reading; a sandbox depends on nobody.
- Prompt guardrails
- A guardrail asks the model not to; a sandbox makes it unable to.
- Staging environment
- Staging isolates the data; a sandbox isolates the agent's capabilities in any environment.
Examples
- Stopping a coding agent from reaching the network except through a corporate proxy
- Blocking OS keychain access for agents that don't need local credentials
- Running a new agent with no write access until it clears review
FAQ
- Doesn't a sandbox slow the work down?
- It slows down the work that relied on access nobody had authorised. Tuned properly, what it removes is surprise, not speed.
- Is a sandbox enough on its own?
- No. The sandbox caps the damage, the registry says what exists, the control plane decides who may act. The three hold each other up.