A6.3 · LESSON 3 OF 6

Sandboxing

Identify instruction-injection attempts and design permission, sandbox, approval and evaluation boundaries for an agent.

THE IDEA

Sandboxing

A sandbox limits what a process can touch according to a defined policy: which files, which network hosts, how many operations. Details matter: resolve a path before comparing it, because /work/../etc/passwd leaves /work, and compare whole path segments, because /workshop is not /work. Anything not explicitly allowed is blocked. A sandbox shrinks the consequences of bad code; it says nothing about whether the answer the code produced is true.

file path

network host

policy: files only under /work; network only to api.example.com file /work/../etc/passwd resolves to /etc/passwd → BLOCK network evil.example.net → BLOCK

A sandbox limits process, filesystem and network effects. Resolve a path before comparing it (a .. can escape), and compare whole segments (/workshop is not under /work). It reduces consequences; it does not make the code's output true.

Try an escaping path and an unlisted host.

Predict first. Does code running inside a sandbox become factually trustworthy?

Chapter context

An agent combines untrusted content with tools that can affect real systems. Reliable operation requires boundaries enforced outside model text, alongside clear task authorization and evidence-based evaluation.

TRY IT YOURSELF

Part 1. Do it hands-on

Judge three operations by hand, then write a path-safe sandbox policy.

file path

network host

policy: files only under /work; network only to api.example.com file /work/../etc/passwd resolves to /etc/passwd → BLOCK network evil.example.net → BLOCK

/work/data/a.txt /work/../etc/passwd evil.example.net sandboxed code is factually trustworthy? (yes/no)

To do: A sandbox allows file access only under /work. Is /work/data/a.txt allowed? Type allow or block
To do: Is /work/../etc/passwd allowed? (resolve the .. first)
To do: The network allow-list is [api.example.com]. Is a request to evil.example.net allowed?
To do: Does code running inside a sandbox become factually trustworthy? Type yes or no

Part 2. Do it in code

normalize(path): resolve "." and ".." segments and repeated slashes in an absolute path; ".." at the root stays at the root. "/work/../etc/passwd" → "/etc/passwd".
inside(root, path): True if the normalised path is the root or below it (compare whole segments: /workshop is NOT inside /work).
net_allowed(host, allowlist): True only for hosts exactly in the allow-list (case-insensitive).
check_op(policy, op): policy has root and hosts; op is {"type": "file", "path": ...} or {"type": "net", "host": ...}. Return "allow" or "block"; any other type is "block".
run_ops(policy, ops, max_ops): decide each op in order but at most max_ops operations: the extra ones are "block" (a resource limit). Return the list of decisions.

def normalize(path):
    pass

def inside(root, path):
    pass

def net_allowed(host, allowlist):
    pass

def check_op(policy, op):
    pass

def run_ops(policy, ops, max_ops):
    pass

Ctrl/⌘ + Enter runs it

Stuck, or something not working? You can come back to it any time.

CHECK YOUR UNDERSTANDING

Does code running inside a sandbox become factually trustworthy?

ANoBYes

Chapter reference: math, worked example & code

This section belongs to the whole chapter, so it is the same on every lesson in it and may cover a different lesson's topic. The code for the experiment you just ran is inside the experiment itself.

Math and notation

For a stated evaluation set:

unsafe\ pass\ rate=\frac{unsafe\ cases\ that\ pass}{unsafe\ cases},\quad false\ block\ rate=\frac{benign\ cases\ blocked}{benign\ cases}.

These empirical rates characterize that set; they are not universal security guarantees. Define denominators and outcome criteria before running the evaluation.

Worked example

An offline evaluation contains 100 unauthorized-action cases, of which 2 pass, and 200 benign cases, of which 5 are blocked. Unsafe pass rate is 2%, and false block rate is 2.5%. Those two numbers measure different failures; averaging them into a single undocumented 'safety score' hides the tradeoff.

Reference code

The following example uses the Python standard library and does not call a remote service.

from math import isclose
unsafe_passes,unsafe_cases=2,100
benign_blocks,benign_cases=5,200
assert isclose(unsafe_passes/unsafe_cases,.02)
assert isclose(benign_blocks/benign_cases,.025)

Python examples are provided for study and local execution; this page does not execute Python.

Common mistakes

A successful prompt-injection defense on one dataset is not a proof for every input. Text instructions cannot substitute for permission enforcement. Audit logs must preserve evidence without exposing credentials.