AI Agent Sandbox Assurance
Examine the boundary between agent execution and the systems around it, including files, networks, secrets and cleanup.
Separate runtime capability from isolation evidence
- Filesystem boundary
- Map allowed mounts and protected host paths.
- Network boundary
- Identify permitted destinations and denied routes.
- Secret boundary
- Trace credential delivery and unintended exposure paths.
- Lifecycle boundary
- Examine resource limits, persistence and cleanup.
Engagement boundary
Agree the work and its boundaries together
The engagement boundary
- Filesystem boundary
- Map filesystem, network, process and secret-access boundaries.
- Network boundary
- The inputs, authorised access and client participants are confirmed before scheduling.
- Runtime owner
- Retains organisational decisions and risk acceptance.
- Additional implementation
- Changing the isolation platform, maintaining images and responding to newly disclosed vulnerabilities are separate work. Findings apply to the configuration and version examined, not every deployment of the product.
What the work covers
- Map filesystem, network, process and secret-access boundaries.
- Review isolation configuration and exercise authorised boundary tests.
- Examine resource limits, persistence, cleanup and recovery behaviour.
Scope boundaries
- Formal certification, legal conclusions and guarantees of safe or compliant behaviour.
- Implementation or ongoing operation beyond the agreed scope.
- Changing the isolation platform, maintaining images and responding to newly disclosed vulnerabilities are separate work. Findings apply to the configuration and version examined, not every deployment of the product.
Decision and fit
Separate runtime capability from isolation evidence
Compare the engagement with the decision you face
- A question worth resolving
- Separate runtime capability from isolation evidence.
- An accountable participant
- Infrastructure and security owners introducing code-execution or computer-use agents into controlled environments.
- Inspectable source material
- The relevant owners can make workflow evidence and agreed inputs available for examination.
- A scope mismatch
- There is no agent execution environment or isolation boundary to review.
The engagement
Examine the boundary between agent execution and the systems around it, including files, networks, secrets and cleanup. An isolation review plus selected authorised boundary tests for a specified sandbox configuration.
The decision at stake
An agent can execute code, but the team lacks evidence about the isolation limits of its runtime.
Suitable situations
- Infrastructure and security owners introducing code-execution or computer-use agents into controlled environments.
Less suitable situations
- There is no agent execution environment or isolation boundary to review.
Working sequence
How the work moves from question to handover
What each stage should leave your team with
- Define the containment boundary
Host, filesystem, network and secret boundaries.
- Review enforcement settings
Runtime restrictions and resource limits.
- Exercise containment and cleanup
Observed containment, exhaustion and cleanup behaviour.
- Define release checks
Checks for future image or policy changes.
How the work proceeds
- Define the containment boundary. Map host access, mounted files, network egress, credentials and persistent state available to a workload.
- Review enforcement settings. Examine privileges, runtime restrictions, resource quotas and separation between concurrent tasks.
- Exercise containment and cleanup. Run agreed probes for forbidden access, exhaustion, persistence and residual data using disposable environments.
- Define release checks. Provide configuration findings and repeatable containment tests for image, policy or runtime changes.
Worked situation
Follow one situation through to a bounded next decision
Illustrative working situation
Illustrative scenario
- Starting condition
A completed workload leaves data in a reusable workspace.
- Question to examine
Inspect teardown and the next isolated execution.
- Possible next action
Document the persistence finding and cleanup verification case.
Decision artefacts
Leave a record the next owner can use
Isolation finding
Illustrative working format
- Subject and version
- Identify the workflow, configuration or proposal examined.
- Filesystem boundary
- Record the relevant requirement and supporting material.
- Secret boundary
- State the observation, supporting evidence and remaining uncertainty.
- Runtime owner
- Record the next decision, follow-up and unresolved question.
What the work can produce
- Isolation boundary map
- Sandbox control findings
- Cleanup and containment verification cases
Working together
Your team and our team need a clear working agreement
Who contributes and who decides
- Client sponsor
- Confirms the decision, priorities and people needed to resolve it.
- Client technical or process owner
- Provides the agreed evidence, access and review of findings or deliverables.
- Softlander delivery lead
- Coordinates the agreed activities, review points, handover and open actions.
- Authorised decision-maker
- Accepts deliverables against the agreed criteria and separately decides operational or business action.
What the work depends on
- Provide runtime and infrastructure owners, deployment configuration, network routes, secret-injection design and disposable test workloads. Agree resource limits, cleanup expectations and authorised probes before execution.
Engagement availability
The start date, named delivery roles, review points and fee basis are agreed after confirming the inputs and scope. Duration depends on evidence access, system complexity and the time your decision-makers need to review the work.
Engagement and handover
Agree the delivery model and what completion means
A clear agreement from scope to ownership
- Scoped work
- Map filesystem, network, process and secret-access boundaries.
- Indicative handover
- Isolation boundary map; Sandbox control findings
- Review and acceptance
- Review the agreed deliverables and record any open items, owners and conditions.
- Ongoing work
- Assign maintenance and operational ownership; agree additional scope and coverage explicitly.
An isolation review plus selected authorised boundary tests for a specified sandbox configuration.
The handover maps intended isolation to configuration and observed test results, including what survives termination. Each finding names the affected host, tenant, network or resource boundary and a verification case.
Changing the isolation platform, maintaining images and responding to newly disclosed vulnerabilities are separate work. Findings apply to the configuration and version examined, not every deployment of the product.