An isolated runtime with explicit limits for agent-executed work.
An agent sandbox constrains filesystem, network, secrets, compute, and process access. Reproducible setup and teardown let background workers operate without inheriting broad authority from a developer machine.