The safeguards map / 3.1 Execution sandboxes
nono
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A runtime security tool that runs each tool an AI agent calls in its own kernel-enforced sandbox under permissions the owner sets, and keeps a tamper-evident record of the session.
Where it sits
3.1 Execution sandboxes (primary): Runs each tool an agent calls in its own ephemeral execution sandbox, isolated from the agent and other tools, with permissions for files, network access, environment variables and credentials that the owner sets in profiles.
Run each tool in its own ephemeral sandbox, isolated from the agent and other tools, with explicit permissions for files, network access, environment variables, and credentials.
captured
Define them in composable profiles and enforce rules such as
captured
3.8 Record-keeping: Keeps a tamper-evident record of agent sessions and security decisions, with integrity verification and optional signing.
Keep a tamper-evident record of agent sessions and security decisions, with integrity verification and optional signing.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- agentsoftware
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
- Can the agent bypass it
- depends
Handoffs
consumes Provenance and signatures: Sigstore signatures
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.