TO me, that's the important distinction: sandboxing limits what the agent can do but it doesn't necessarily enforce that the agent must run inside the sandbox. You need a separate control layer to enforce that boundary.

You design the sandbox so the agent starts in that layer. The next thing you can do is to limit the network access, this is what I'm working on right now.

Or do you mean something else?