Tool Sandboxing and Egress Control

Mental model

A sandbox limits what compromised or mistaken execution can reach; egress policy limits where observed data can leave.

Learning outcomes

• Explain the mechanism and ownership boundaries behind Tool Sandboxing and Egress Control.
• Compare the main design alternatives and their operational trade-offs.
• Diagnose common failures and select evidence for a production decision.

Theory

Combine least-privilege identities, disposable environments, read-only inputs, allowlisted outputs, network destinations, resource quotas, syscall controls, and teardown verification. Treat sandbox escape and credential access as separate risks.

Trade-offs

Stronger isolation reduces blast radius but limits tool compatibility and adds startup cost. Network allowlists block exfiltration but require explicit dependency management.

Failure modes and misconceptions

Calling a container a sandbox; mounting host credentials; allowing unrestricted DNS or HTTPS; writable shared volumes; no CPU or memory limits; and trusting cleanup alone.

Decision scenario

A code agent must run an unknown repository's tests. Design the filesystem, secret, network, process, and artifact boundaries.

Primary sources

• owasp-llm
• nist-zero-trust