congrats on the launch.

i think the sandbox part is getting commoditized, like others said. the harder part is what the agent can touch inside it.

you connect google, the agent gets access to everything. sandbox protects the host. it does not protect your tokens.

scoped, short lived credentials per task. that i would pay more for. is it on your roadmap?

Short-lived tokens only limit how long a credential works, but better than nothing. i.e. They don't stop an unwanted action while it's still valid.

A practical pattern is an outside broker: the guest never sees the real credential and can't pick the destination, only a path from an allowlist.

Shameless plug for my project, I maintain one of these brokers: Plimsoll's broker sits outside the sandbox, injects the upstream credential itself, matches method + exact path (no query strings, no traversal, no encoding tricks), and enforces (some limitations that I am want to improve) a total call budget plus per-route caps. So a task can be granted "GET /items/* plus at most one job submission" even when the underlying key is coarser.

Worth a look if you're thinking about narrower credentials for services whose keys are still coarse: https://github.com/plimsollmark/plimsoll (docs/capability-grants.md, and the broker walkthrough at https://plimsollmark.github.io/plimsoll/trainers/brokering.h...).