Sandbox Before Execute

Assume the agent will eventually run hostile code, whether because a user asked or because injected content told it to.

Minimum bar before executing anything the agent did not write under direct supervision:
1. Filesystem scoped to a workspace. No reach to credentials, SSH keys, cloud metadata endpoints or environment files.
2. Network denied by default, allowlisted where genuinely needed. Cloud metadata endpoints blocked explicitly.
3. Hard limits on CPU, memory, disk and wall clock, with a defined behaviour on hitting them.
4. No long-lived secrets in the environment. Inject scoped, short-lived credentials only where required.
5. Container or microVM boundary. Be honest about the difference: a container is not a security boundary against a determined escape.
6. State does not persist between runs unless persistence is the explicit point.