The safeguards map / 3.1 Execution sandboxes
OpenShell
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A runtime that runs autonomous AI agents in isolated sandboxes and enforces an owner-declared policy on file access, system calls and network connections.
Where it sits
3.1 Execution sandboxes (primary): Runs each agent in an isolated sandbox with kernel controls on file access and system calls, and checks every outbound network connection against the owner's declared policy.
every network connection passes through a policy check before it leaves the sandbox
captured
Each sandbox combines runtime isolation with OpenShell policy controls that prevent unauthorized data access, credential exposure, and network exfiltration.
captured
You declare what each agent can touch in a policy, and OpenShell enforces it.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- agent
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
- Can the agent bypass it
- depends
Handoffs
None recorded. A mapped entry with no handoff is here for its foundation home.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.