You ask the agent to check that a migration applies cleanly. It reads the connection string sitting in its environment, opens a session, and runs the SQL it wrote after reading the ticket. The migration applies. So does the statement further down that rewrites a column nobody mentioned, because the credentials in the environment were the admin ones — they were the ones that worked. The container held perfectly. Nothing escaped it. Everything that mattered was at the other end of a connection the container was never asked about.

The button asks, the governor does not

Stand in a lift and press a floor. The press is a request. It goes to a controller, and a controller is software: it can be given a new schedule, a new priority, an override for the goods delivery on Thursday. Now ask what stops the car falling. Not the controller. A governor spins with the car, and when it turns faster than it should, a linkage clamps the safety gear onto the steel guides in the shaft. No instruction reaches it. It does not know the controller exists, and it grips regardless of what the controller believes.

Telling a model which paths are off limits is pressing a button. It usually complies, and none of it survives a document that tells it otherwise. Kernel-enforced policy is the governor. The rules about files, processes and network are declared once and applied by the runtime the agent lives in, checked against paths and system calls, so the agent reads the repository it was handed and cannot write outside the directories it was granted. Traffic leaves through a proxy that reads the method and the path, so fetching from an API and posting to one are different permissions, and the credential for that call is injected at the boundary rather than handed inside.

Parts of a lift can be adjusted while it runs and parts can only be touched with the car out of service. Policy splits the same way. The fundamental limits are fixed when the sandbox is created; the tunable rules can change during a run. Making the first kind reloadable turns a constraint back into a setting.

A compromised model still meets the kernel

This is the difference between an instruction and a constraint, and it is the whole reason to bother. A poisoned web page can change what the model believes about its own orders. It cannot change what the runtime permits, because that decision was never the model’s to make. Code execution follows from there: the agent asks for a short-lived machine, runs what it wrote, and gets back only what the sandbox exposes — output and named artifacts. The machine’s life is not the agent’s process, so it can be destroyed while the conversation carries on.

Three ways to hollow this out. Put a secret inside the sandbox with no scope and no expiry, and the isolation only bounds where it was spent. Treat a network proxy as a stand-in for isolation on the machine itself, and the local filesystem is still open. Hand a sandbox that one task dirtied to the next task, or the next user, and you have a shared computer with extra steps. Isolation is a floor, not a policy — which is what putting the agent inside the sandbox buys you and also all it buys you. Once nothing mediates each call, the layer underneath has to be the one saying no.

Draw the line around the task

The thing an agent damages is often not the machine it runs on. So the same idea gets drawn around a task instead of a box. A disposable database sandbox gives one task its own database and its own login role, with a lifetime, quotas, and bounds on the SQL going in and the rows coming back. Checking the work does not need the admin connection: you compare a schema digest, or read a diff. At expiry the database is deleted, including when the task failed, especially then.

That only becomes normal if strong isolation stops being expensive, which is what cloning a snapshot does. A machine already booted, with its toolchain and repository in place, is checkpointed down to its memory; each new instance restores that state and shares the pages read-only until it writes its own. A hundred candidate patches get a hundred instances, each verified and thrown away, none of them standing on what the last one changed. The checkpoint is not neutral, though: it carries whatever was open when it was taken, tokens and caches included, and every clone inherits the same random seed until something reseeds it.

Ask what stops your agent. If the answer is that you asked it not to, nothing does.