Society · Protocols
AgentSandbox
Isolate agent execution with resource limits and egress controls
Definition
Mechanism
Execution isolation for AI Agents treating them as untrusted insiders. The Agent runs in a containerized environment (gVisor, Firecracker microVM) with: resource quotas (CPU, memory, time), network egress allowlists, filesystem restrictions, and comprehensive logging. Code generated by the Agent is executed in this Sandbox, preventing impact on production systems even if the agent is compromised or generates malicious code. It wraps the execution Context with InputGuard to sanitize ingress data and OutputGuard to prevent exfiltration, effectively placing the Agent in a digital quarantine.
Preconditions
- Resource limits defined
- Untrusted code/agent
Postconditions
- Execution completed or terminated by supervisor
Invariants
- Network egress is whitelist-only.
- The sandboxed process cannot reach the host filesystem.
- Declares resource quotas for CPU, memory and time.
- Every action inside the Sandbox is logged.
Risks
Failure modes
{{sandbox}} Escape
Exploiting container vulnerabilities.
Quota Starvation
Legitimate tasks failing due to overly restrictive limits.
Log Blindness
Missing critical events in Audit logs.
Relationships
Builds on
Composes with
Infrastructure
Input validation and sanitization
Infrastructure
Final egress filter for safety and privacy
Used by
References
Mind
Predictive modeling of external agent states
Mind
Predictive modeling of system dynamics
Reference
Signature
Sandbox(Agent)