Constrain what the agent can touch

Run the agent in an OS-level sandbox with a workspace path guard that resolves symlinks, scrub credentials from the command environment, run agent-written SQL read-only with timeouts and row caps, and set resource limits on generated code.

Tier 2 because safety containment.

When it applies

• In the code: shell or code execution without a sandbox; credentials in the agent's environment; write access where read is enough; no row cap or timeout on agent SQL
• In traces: commands touching paths outside the workspace; queries returning very large result sets; failure rows labeled unauthorized-irreversible-action
• In eval results: safety evals with out-of-bounds actions

How

1. List what the agent can reach (paths, credentials, databases, network).
2. Remove write access and credentials it does not need; add the path guard and limits.
3. Run the safety evals before and after.

How to measure it

• before after (tier 2): safety evals and out-of-bounds action attempts

To compare the change against your agent's current version, with the same cases and enough repeats to see past run-to-run noise, use aot-evals.

Expected impact

• Quality: none
• Cost: degrades, small
• Performance: degrades, small

Evidence

Evidence comes from: Code generation, Data analysis, Tool use.

1. Sandbox execution at the OS levelNot measured

   Codex vendored Bubblewrap with "--ro-bind, --unshare-net, --unshare-user, --unshare-pid"; "Protected paths (.git, .agents, .codex) are re-marked read-only even when they sit inside a writable root"; described as "a substantial multi-thousand-line investment."

   Barbaste et al., "Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems" · Jul 2026 · Sec 8.5; Sec 10.2 Layer 4; Observation 6; Recommendation 10

2. Scrub credentials from the command environmentNot measured

   Gemini CLI "environment scrubbing of provider credentials (name-pattern regexes over TOKEN/SECRET/KEY/AUTH/CREDENTIAL, a denylist, and GitHub-token value regexes) before each command runs."

   Barbaste et al., "Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems" · Jul 2026 · Sec 8.5

3. Gate actions with workspace guard and allow/ask/deny permissionsNot measured

   Held fixed, not ablated. The deny and allow lists are given in the bash tool description.

   Fan et al., "An Empirical Study of Harness Design for Coding Agents" · Sep 2026 · §2.4 Safety; App 8.3 Fig 27

4. Restrict agent SQL to read-only with timeout and row capsNot measured

   Implementation detail (Appendix B.2), not ablated.

   Youngwon Lee, Jaejin Kim, Seung-won Hwang (Seoul National University), "Bootstrapping Semantic Layer from Execution for Text-to-SQL (GATE: Grounding After Test from Execution)" · Jun 2026 · Appendix B.2

5. Sandbox agent-generated code with limits and monitoringNot measured

   "Running agent-generated code requires a secure execution environment with appropriate sandboxing, resource limits, and monitoring. These infrastructure requirements add operational overhead and security considerations that direct tool calls avoid."

   Adam Jones, Conor Kelly (Anthropic), "Code execution with MCP: Building more efficient agents" · Nov 2025 · Benefits: State persistence and skills (closing note)

Also known as

• Tool capability compartmentalization

Related

• 2.a.iiiChoose how the agent acts: typed tools, code execution, or shell, matched to the model and task
• 10.b.iGate irreversible actions: allow, ask or deny by side effect
• 6.c.iCode-then-execute (CaMeL)
• 10.c.iContain sensitive data and untrusted input
• 7.d.iContinuous autonomous task loop
• 4.b.iFilesystem-based agent state and checkpoints
• 5.c.iiSub-agent architectures with clean contexts
• 6.b.iiLLM map-reduce
• 6.c.iiPlan-then-execute

In Claude Code

This optimization is a skill in aot-kit, our open-source Claude Code plugin: /aot-kit:constrain-agent-reach. Its library entry holds every source. Have new evidence, or a correction? Suggest a change.