Sandbox
Also called Agent sandbox
A boundary enforced by the operating system that limits what a running command can touch: which folders it can write to, which it can read, and where it can connect. It holds even when the agent has been tricked.
Prompts depend on you paying attention, and rules match text. A sandbox doesn't care how a command is spelled, which is what makes long unattended runs reasonable. But read the defaults before you rely on one, because they are not what most people assume.
Say it to your agent
“Turn on the sandbox with /sandbox. Add ~/.ssh and ~/.aws to sandbox.filesystem.denyRead, allow only registry.npmjs.org in sandbox.network.allowedDomains, set allowUnsandboxedCommands to false, then run cat ~/.ssh/config and show me it fails.”