CapabilitiesRuntime Enforcement
27AI SECURITY
Sandboxing & Execution Boundaries
Assume untrusted code/content may succeed at local compromise; design the surrounding boundary to contain it.
- Priority
- P1
- Phase
- Phase 2
- Primary owner
- Platform Security
- Status
- Blueprint
Objective
Some agent tasks require executing code, browsing the web or handling untrusted files. These workloads need isolation because policy alone cannot guarantee that arbitrary code or content behaves safely.
What to build
- Ephemeral sandbox for code execution and untrusted files.
- Network egress allowlists and DNS/domain controls.
- Filesystem and process isolation with resource limits.
- Read-only or synthetic datasets for testing high-risk workflows.
- Automatic teardown and evidence capture after run completion.
Implementation decisions
- Prefer disposable execution environments with no standing secrets.
- Inject temporary capabilities only after policy approval.
- Prevent sandbox-to-control-plane lateral movement.
- Define separate assurance tiers for browser automation, code execution and data transformation.
Definition of done
- Compromised sandbox cannot access another tenant or production secret.
- Egress attempts outside policy are blocked and logged.
- All ephemeral credentials expire when the sandbox ends.
Success metrics
- Sandbox escape findings
- Unauthorized egress blocks
- Average sandbox lifetime
- Privileged sandbox sessions
ISOLATION PRINCIPLE
Assume untrusted code/content may succeed at local compromise; design the surrounding boundary to contain it.
This control is specified on page 27 of the blueprint.