Building Autonomous AI Agents · Module 3 · Guardrails, Sandboxing & Verification
Sandboxing & Privilege Boundaries
7 min read · lesson 5 of 6
Allowing an autonomous agent to execute arbitrary code, shell commands, or database writes carries serious risks. Production agent architectures enforce strict privilege boundaries and sandboxing to guarantee system security.
Key Security Boundaries
- Read vs Write Separation: Allow safe read operations (e.g. `read_file`, `query_catalog`) autonomously, but require human confirmation for destructive write operations (`delete_record`, `send_email_blast`).
- Execution Sandboxing: If the agent executes user-supplied code or shell commands, isolate execution within isolated containers or WebAssembly runtimes with no host filesystem or network access.
- Path Traversal Prevention: Ensure file-access tools resolve all paths against an explicit workspace directory root and reject attempts to escape via `../`.
Never allow an agent to run destructive commands (DROP TABLE, rm -rf, sending payments) without an explicit Human-in-the-Loop approval gate.
Practice
Identify three potential risks in an agent that has direct access to run arbitrary SQL queries on a production database, and design guardrails for each.