Sandboxed Tool Execution
Execute tool calls inside an isolation boundary so that misbehaviour, side effects, and errors are contained.
This page is the complete instruction page for one pattern called "Sandboxed Tool Execution." It explains the problem this pattern solves, the idea behind the solution, when you should (and should not) use it, and what happens afterward, both the good effects and the costs.
This matters because building AI agents is not just about making them clever. It is also about making them safe and predictable. Following a well-tested pattern like this one helps avoid common mistakes, and shows you exactly which safety rules and regulations it connects to, listed under "Standards Mesh" on this page.
Context
Tools that touch real systems (code execution, shell, SQL, file system, browser) can cause damage that outlives the agent turn. Production agents without sandboxing have caused real incidents.
Problem
Direct execution of model-generated commands against production is unacceptably risky.
Forces
- Capability vs blast radius
- Sandbox fidelity vs overhead
Solution
Run tools in isolated environments with declared resource limits, time limits, network policy, and credential scoping. The sandbox is the only entity that holds elevated credentials; the agent never does. Observability captures every attempt, successful or denied.
Where this pattern acts in the two lifecycles
04 Act. Tool call, API invocation, environment mutation. 15 of 61 catalogue patterns act at this stage.
04 Deploy. Staged rollout, sandboxing, whitelisting. 9 of 61 catalogue patterns act at this stage.
Stages and counts from the catalogue data. The Runtime lens is the loop the agent runs each turn; the AgentOps lens is the lifecycle the team runs the agent through. See the Matrix for every pattern at each stage.
Applicability
- Code-execution tools
- Browser / computer-use agents
- Agents with shell, SQL, or file system access
Anti-Patterns
- Giving the agent direct production credentials
- "Trusted prompt, no sandbox needed"
Consequences
- +Contained failure modes
- +Denies escalation paths
- −Operational overhead
- −Some tools hard to sandbox (browser automation)
