Sandboxing — For Developers

Edition D — operators & integrators who run agentteams. How-to + Reference: which knob do I turn, and what does it cost. Runnable commands, file:line pointers, Core→Full on the controls you operate. For the complete mechanism, follow the links into the Reference edition.

The 60-second version

1. Confinement is emitted by default but inert until wired: as of 2026-W39 the default privilege_profile is confined, which emits an OS write-confinement boundary (a settings/config example you must merge); the deny-hook still stays fail-open unless you set an explicit confined/exclusive. Set cooperative to emit no sandbox at all.
2. agentteams decides whether it can emit a boundary for your framework × OS, and emits an artifact — but that artifact is inert until you wire it.
3. On Linux you must wrap your agent: sandbox/confine-run.sh --scratch DIR --egress deny -- <your agent cmd>. Nothing is confined until you do.

Contents

• Part I — What it is & why (SB1–SB3)
• Part II — The request (SB4–SB6) — the knobs you set
• Part III — The decision (SB7–SB9) — what agentteams will/won't emit
• Part IV — The mechanisms (SB10–SB13) — the three artifacts
• Part V — Wiring & enforcement (SB14–SB17, SB24) — how to activate + verify; the orchestrator-only write policy
• Part VI — Integrity & drift (SB18–SB19)
• Part VII — Ceilings & red-team (SB20–SB21)
• Part VIII — Synthesis & reference (SB22–SB23) — the tables

Diagrams in this edition: G1 (pipeline, Part I), G2 (decision, Part III), G3 (mechanisms, Part IV), G4 (hook, Part V).