# Sandbox > VI: https://5ac.vn/wiki/sandbox/ · EN: https://5ac.vn/en/wiki/sandbox/ · lang: en · spec_as_of 2026-10-19 (spec no formal spec) · cluster C13 An isolated runtime: an AI agent executes against sample data and low privileges before it touches production data, so a mistake stays inside the isolated boundary. --- ## Definition A sandbox is an isolated runtime: the agent runs inside a space where data, privileges and outbound routes are limited in advance — sample data, low read access, an allow-list of tools — instead of reaching straight into real records. 5ac's three-species article says the same when it describes Codex's sandbox as "on by default (the agent runs in an isolated environment and can't touch your system on its own)". For code the model produces, MPLSandbox (arXiv:2410.23074) calls the place where compilation and execution happen an isolated sub-sandbox. A sandbox does not become a policy by itself: the four components it travels with — identity, permissions, audit log and the sandbox itself — are written up as component clauses in the [Agent orchestration](/en/wiki/agent-orchestration/) entry, and their running form is Execution Containers in [Multi-agent OS](/en/wiki/multi-agent-os/). ## Mechanism A sandbox holds four boundaries while the agent runs: | Boundary | What the sandbox limits | What happens without it | | --- | --- | --- | | Data | trial runs use sample or anonymized data only | a new agent reaches real customer and order records | | Privileges | low read access, tools picked from an allow-list | one wrong action spreads across the system with no stopping point | | Outbound routes | each path that sends data outside is enabled by policy | internal data leaves the server with nobody approving it | | Consequences | snapshots that allow rollback, an approval gate before writes | a wrong change cannot be undone | *The Balkanization of Execution-Security Research for AI Coding Agents* (arXiv:2607.05743) sets the bar: it gathers 39 papers from 2023–2026 on isolation and access control, checks four disclosed and patched holes in production agent harnesses, and reports policy-enforcement failure rates of 69–98% — the reason to measure a sandbox instead of assuming it is safe. The three-species article adds the product angle: Codex ships with the sandbox on, while Pi has none by default and the user must containerize it. ## Application context The Execution Containers article sets the frame 5ac gives Vietnamese SMBs: "This is not merely a technical sandbox; it is an operating contract between leadership, IT and business workflows" — before running, the system must know what the agent may read, call and send outside. The 30-day path in the secure orchestration piece follows the same order: week one fixes the data the agent may read and must never touch, week three runs against sample data, and only then do real permissions open to a small team. The same article notes sub-second sandboxing talk, with 5ac's condition: speed only creates value inside a clear control boundary. The word also appears in governance: 5ac's AI governance audit checklist says restricted systems — what a company cannot control yet — should pause or stay inside a sandbox. There a risk classification holds the system back; here the runtime does. Start here: keep a sandbox and an audit log for every new agent — without the log you cannot tell what your sandbox blocked. ## Sources fetched - [Secure Agent Orchestration for Vietnamese SMBs: Identity, Audit Logs, and Control](/en/blog/secure-agent-orchestration-layer-vietnamese-smbs/) — sandboxing for new agents, the 30-day path, sub-second sandboxing — accessed 2026-10-19 - [Multi-agent orchestration and Execution Containers: how Vietnamese SMBs can run AI agents safely after Microsoft Build 2026](/en/blog/multi-agent-orchestration-execution-containers-microsoft-build-2026/) — policy-bound runtime, sandbox as an operating contract — accessed 2026-10-19 - [Codex, Pi, Hermes — Three Species of AI Agents, Not Three Rivals](/en/blog/three-species-of-ai-agents-codex-pi-hermes/) — sandbox on by default in Codex, no default sandbox in Pi — accessed 2026-10-19 - [What Is a Multi-Agent OS? The Enterprise Architecture Behind Reliable AI Agents](/en/blog/what-is-multi-agent-os/) — week three runs sandbox tests with sample data — accessed 2026-10-19 - [AI Governance Audit Checklist for Vietnamese SMBs in 2026: a 30-day self-audit plan](/en/blog/ai-governance-audit-checklist-vietnam-smb-2026/) — restricted systems paused or kept inside a sandbox — accessed 2026-10-19 - — Multi-Programming Language Sandbox for LLMs (v2) — verified via arXiv API 2026-10-19 - — The Balkanization of Execution-Security Research for AI Coding Agents (v1) — verified via arXiv API 2026-10-19 ## Related - [Agent orchestration](/en/wiki/agent-orchestration/) - [Multi-agent OS](/en/wiki/multi-agent-os/) - [AI guardrail](/en/wiki/guardrail/) - [Audit log](/en/wiki/audit-log/) - [Coding agent](/en/wiki/coding-agent/)