Overview › 10Safety › a.Sandboxing

Sandboxing

Constrain what the agent can touch. 1 optimization.

1. i.

   Constrain what the agent can touch

   Run the agent in an OS-level sandbox with a workspace path guard that resolves symlinks, scrub credentials from the command environment, run agent-written SQL read-only with timeouts and row caps, and set resource limits on generated code.

   Higher costSlower

   Tier 2 · reliability · changes guardrails · any agent · 5 sources