An educational model of agent containment. A simulated agent throws abstract probes at its boundaries — and you watch each containment layer catch them. This teaches the part that matters for evaluating safety: why the box holds. The probes are labeled by class only; no real techniques — every probe is caught, because that's what defense-in-depth does.
| Layer | Catches (probe class) | Why it holds |
|---|---|---|
| Capability Restriction | requests for a tool/permission never granted | the agent can only call what was handed to it; unlisted capabilities don't exist in its world |
| Network Isolation | attempts to reach an outside host | no egress route exists; a call outward has nowhere to go |
| Filesystem Boundary | access outside the allowed scratch space | paths outside the mount aren't visible; the rest of the disk isn't in reach |
| Frame / Same-Origin Isolation | touching the parent page or another origin | the browser's sandbox attribute walls the frame off — this artifact runs in exactly this |
| Resource Limits | exhausting CPU / memory / time | hard quotas halt runaway work; the agent can't spend past its budget |
| Audit / Witness | everything — each probe is logged | an exterior witness records every attempt; observed containment is verifiable containment |
The first five layers block. The sixth witnesses — and it's the one that turns "we believe it's contained" into "we can verify it's contained." A sandbox with no audit is a claim; a sandbox that logs every boundary-probe is a claim you can check from outside. This is the session's through-line: a closed system can't witness itself; the boundary witnesses it. The audit layer is the exterior gap that makes the whole box provable, not just hopeful.
This is the defender's model — the thing you need to evaluate whether a sandbox is sound: the layers, what each catches, and why the walls hold. It deliberately shows no escape techniques — the probes are abstract boundary-tests, every one caught. Understanding containment from the defense side is what lets an auditor judge it, a builder design it, and a student learn why the box is a box. The lesson isn't "here's a way out" — it's "here's why there isn't one, and here's how you'd verify that."