Sandboxing — For Researchers

Edition S — security reviewers & threat modelers, new to this stack. Explanation + Reference: the why, the adversary, the guarantees and their ceilings. Concept-first — the threat model before the mechanism names. Minimal code. For the mechanism internals, follow into the Reference edition.

The claim under review

agentteams boxes a design-time agent (one that builds a project) so an injected or mis-followed instruction cannot escape the declared workspace. This edition foregrounds the adversary, the trust boundaries, and — most important for a reviewer — each control's stated ceiling, because the failure mode this subsystem most guards against is false confidence (an emitted boundary that confines nothing).

Contents

• Part I — What it is & why (SB1–SB3) — the adversary + opt-in posture
• Part II — The request (SB4–SB6)
• Part III — The decision (SB7–SB9) — the capability/advisory model
• Part IV — The mechanisms (SB10–SB13)
• Part V — Wiring & enforcement (SB14–SB17, SB24) — inert-until-wired; the orchestrator-only write policy and its TCB
• Part VI — Integrity & drift (SB18–SB19)
• Part VII — Ceilings & red-team (SB20–SB21) — the honest verdicts
• Part VIII — Synthesis & reference (SB22–SB23)

Diagrams: G1 (pipeline, Part I), G2 (decision, Part III), G6 (synthesis, Part VIII).