How are agent sandboxes isolated?
Every task run gets its own sandbox under a dedicated controller, with a network posture you set and no standing credentials inside it. The sandbox is discarded after the run.
Each task run owns one sandbox; agents do not keep a persistent machine. In Kubernetes deployments sandboxes are provisioned by a dedicated controller in its own namespace, separate from the application. A sandbox reaches the platform through the app origin and reaches other systems only through brokered connectors.
Network access from a sandbox is a deployment posture (open, domain allow-list, or workspace-only) that is stated to the agent. Credentials are issued per action and expire; when the run ends the sandbox is deleted and its record stays with the task.
Written for it and security, deployment engineers. Last reviewed 2026-09-15.
Related questions
Still need an answer?
Tell us what you were looking for and we reply within one business day.
Contact the team →Running a security review?
Documents, controls, and the request form live in the Trust Center.
Open the Trust Center →