Agent Sandboxing Ethics

Sandboxing ethics means an agent works in a disposable machine that sees almost nothing, and anything irreversible waits for a human before it touches the world.

Agent code runs inside a disposable sandbox that sees only one work directory, so four values sum to 40 with mean 10 while host reads stay denied and publishing waits for a human.

Why Does This Exist?

An agent that can run code can ruin a week before lunch. A cleanup command aimed at a temp folder wipes a home directory. A pasted web page carries instructions that tell the agent to read secrets and send them out. A helpful loop retries a failed payment three times and charges the customer thrice. Traditional bugs crash programs. Agent mistakes act in the world, and the world does not have an undo button.

Sandboxing ethics is the answer to who allowed that. It has two halves. Containment gives agent-written code a disposable machine holding nothing valuable: no host files, no secrets, no open network. If the code deletes everything in sight, it deletes a fake disk headed for the bin. Consent parks every irreversible act, sending, publishing, paying, deleting, in a queue for a human before it crosses into the world. Containment limits the blast. Consent guards the exits.

This page covers that ethical layer: what gets isolated, what gets approved, and why neither works alone. The isolation mechanism itself lives in agent sandboxing. Who the agent may act for and what each call may touch connects to human-in-the-loop agents. What the agent remembers across runs lives in agent memory types, and how agents hand work to each other lives in agent communication protocols.

Basics first: a sandbox is a fresh machine built per run and destroyed after, with one allowlisted directory mounted and the network closed by default. Least privilege means it gets exactly the access its task needs and nothing more. Everything below assumes that shape and asks what it owes the people outside it.

Think of It Like This

The school lab's fume hood and sign-out sheet

A student gets chemicals and a glass box with its own beakers and tray. A spill stays on the tray. Only the written reading slides out under the glass, and the tray liner goes in the bin before the next class. That is containment.

But the hood never decides whether the experiment should happen. Taking a sample home needs a signature on the sign-out sheet, and the teacher reads it first. That is consent.

Point for point: the student is the agent, the mixture is the generated code, the glass is the sandbox boundary, the tray is the allowlisted directory, the written reading is stdout, binning the liner is destroying the machine, and the sign-out sheet is the human approval queue. Skip either half and something breaks: a hood with no sign-out lets a student walk out with anything, and a sign-out with no hood lets the spill reach the hallway.

How It Actually Works

The rule is simple: the agent never executes anything and never touches the world directly. It submits requests. A small piece of your code, the broker, runs code somewhere safe and hands back only the result, while a policy gate holds irreversible acts for approval.

The boundary: what crosses and what does not

Think of each run as three parts: C, the code text the model wrote; F, the declared input files, which must sit under one allowlisted directory such as /work; and L, the limits for the run, covering CPU, memory, wall-clock time, and network, which defaults to closed.

The broker builds a fresh machine around that request: a container or a microVM with its own kernel. It mounts only /work, scrubs secrets from the environment, and closes egress. The code runs, and the broker captures three things: the exit code, stdout, and stderr. Then it destroys the machine. Host files, credentials, and sockets never cross the boundary in either direction.

The gate: what waits for a human

Some acts must reach the world: sending an email, merging code, charging a card. Those never run straight from the sandbox. The gate intercepts them, parks them with their full context, and waits. A human approves or rejects, and only approval releases that one act. Bulk pre-approval defeats the purpose, so the queue stays per-act for anything that cannot be undone.

Worked example: four numbers, two refusals, one wait

The container sees one file, /work/orders.csv, holding four values: 8, 14, 6, and 12. The agent's script asks for the sum and the mean, then tries two extras: reading /etc/passwd and opening a socket, plus publishing the result.

The sum goes step by step: 8 + 14 = 22, then 22 + 6 = 28, then 28 + 12 = 40. The mean divides by the count: 40 / 4 = 10. So stdout carries sum = 40 and mean = 10, exactly what the picture above draws.

The scorecard: four requested acts, one allowed, two denied, one parked. The file read under /work is allowed. The host path read is denied because only /work is mounted. The socket is denied because egress is closed. Publishing waits for a human because it cannot be undone. That is the ethics in one run: freedom to compute, no freedom to reach, and consent at the exits.

This assumes the broker cannot be talked into mounting something sensitive. A confused broker, a shared kernel bug, or secrets left in the sandbox environment breaks the whole promise, which is why sandboxing sits inside a layered setup rather than standing alone.

Code

The point here is the policy check, not the arithmetic. This stdlib-only snippet mirrors what the broker decides for every path and socket, plus the four-number computation, so the allow and deny logic reads as plain code:

1def is_path_allowed(path: str) -> bool:2    return path.startswith("/work/")3
4
5def is_socket_allowed(egress_open: bool) -> bool:6    return egress_open7
8
9def needs_human(action: str) -> bool:10    return action in {"send", "publish", "pay", "delete"}11
12
13def summarize(values: list[float]) -> tuple[float, float]:14    total: float = sum(values)15    mean: float = total / len(values)16    return total, mean17
18
19orders: list[float] = [8.0, 14.0, 6.0, 12.0]20total, mean = summarize(orders)21print(total)  # -> 40.022print(mean)  # -> 10.023print(is_path_allowed("/work/orders.csv"))  # -> True24print(is_path_allowed("/etc/passwd"))  # -> False25print(is_socket_allowed(False))  # -> False26print(needs_human("publish"))  # -> True

The outputs match the worked example: 40.0 and 10.0 from 8 + 14 + 6 + 12, True for the work file, False for the host path and the closed socket, and True for the publish gate. In production these functions live in the broker, never in the agent, and the agent cannot edit them.

Watch Out For

Treating a shared-kernel container as the whole boundary

The symptom is confidence in one wall. A container shares the host kernel, so a kernel bug lets crafted code break out onto the host, past every path rule the broker enforced. The run logs look clean because the enforcement happened at the wrong layer.

Fix it by matching isolation to trust: containers for code you mostly trust, microVMs with their own kernels for untrusted or internet-shaped input, plus CPU, memory, and time caps on every run. One fresh machine per run, destroyed after, with no exceptions for warm caches.

Letting safe tools smuggle data out together

The symptom is a leak with no single guilty call. The agent may read files and may fetch URLs, each allowed alone. A crafted instruction combines them: read the secrets file, then append its contents to a request sent somewhere the allowlist permits. Each gate passes. The data still leaves.

Fix it by gating where data goes, not just what the agent may do: start with egress closed, allowlist named domains only when the task truly needs them, and never place live secrets in the sandbox environment. Review the proxy logs for odd outbound calls, because this failure shows up there, not in the files.

The Quick Version

Sandboxing ethics pairs containment with consent: a disposable machine for computing, plus human approval at every irreversible exit.
Only the exit code, stdout, and stderr cross the boundary while host files, secrets, and the network stay outside.
Four values of 8, 14, 6, and 12 sum to 40 with mean 10 while a host read and a socket stay denied.
Sending, publishing, paying, and deleting always pause for a human because none of them can be undone.
Untrusted code needs microVM isolation rather than shared-kernel containers alone.
Closed egress with named allowlists stops two individually safe tools from smuggling data out together.