Confidence: high. Evidence: production telemetry and case study. Last substantive change: 2026-07.
This subsystem owns where and how agent work runs: the sandbox, the credentials, and the boundaries that cap what an agent can do regardless of what it decides to do.
The conclusion
Default to isolated, reproducible, short-lived execution with filesystem and network boundaries, scoped credentials, and no production secrets directly available to the model. Containment is the last line of defense when verification and judgment fail, and it must be architectural rather than dependent on approval prompts.
How the thinking got here
Local developer permissions gave way to per-action prompts, then to sandboxes, containers, and sealed virtual machines, then to credential brokers and containment matched to blast radius. The lesson that forced this progression is blunt: an irreversible action can complete faster than any human can intervene, so the boundary has to exist before the action, not after.
Credible alternatives, and when each is right
| Approach | Right when |
|---|---|
| Host execution with approvals | trusted, owned, low-risk work |
| OS sandbox | light isolation is enough |
| Container | reproducibility and parallel safety |
| Sealed virtual machine | high-risk or untrusted code |
| Remote ephemeral environment | scale and clean-slate runs |
| Air-gapped or simulated environment | maximum blast-radius control |
Where it fails and what we still don't know
Failures include an irreversible destructive action reachable without containment, covert channels, and secrets exposed to a context that can be injected. First-party security engineering strongly favors containment over approval fatigue; environment fidelity remains a practical trade-off. Open questions include sandbox-escape testing, dependency and network policy, identity attribution, and secretless workflows.
What would change our mind
Evidence that human approval at production volume reliably prevents irreversible mistakes would soften the case for architectural containment. The current evidence points the other way.