SANDBOXING AND ISOLATION FOR SAFETY

WHERE SANDBOXES FIT IN THE SEVEN LAYERS Isolation belongs to the governance layer, but it also touches execution, because the runtime environment you learned about in Chapter 12 is where the wall is built. Think of Chapter 12 as showing how to build rooms for running code, and this chapter as explaining how to lock them properly. SANDBOXES AND THE PRACTICE LAB In the Practice Lab the permission gate you built in Chapter 65 plays the role of a very small sandbox, because it keeps the agent inside the project folder and refuses anything outside. It does not provide the strong isolation of a container, but it teaches the habit of starting closed and opening only what is needed. Test it by asking the lab agent to read a file outside the project folder and confirm that the request is refused and recorded. Then think about what extra protection a real product would need if the agent could run code and not only read resumes. QUESTIONS TO ASK ABOUT ANY SANDBOX Ask what the code inside can see, what it can change, and what it can reach on the network. Ask how long it can run and how much it can use. Ask what is erased at the end and what is kept. Ask who is told when something is blocked. If you can answer all four plainly, you understand the sandbox well enough to trust it for the job it was chosen for.