Sandbox

Agents and tools

A fenced place where an agent’s actions run: only allowed folders are visible and only allowed network hosts are reachable. If the agent errs or is tricked, the damage stays inside. Some products fence only terminal commands, others run the whole agent inside a container or a virtual machine.