Stacks and Flows

Implementation Guide · Source-verified

Coding-agent sandbox controls: a practical decision guide

A coding agent's useful autonomy depends on the permissions around it. Sandbox, network, approval, and logging controls form one boundary; none removes the need to review the workload and the resulting change.

Security boundary

Trust boundaries around a coding agent

Prompt / task
enter boundary
Sandboxed workspace
allow only
Scoped tools
request gate
Human approval
release change
Merge / deploy
Constrain credentials, filesystem scope, network access, approvals, and the final merge independently.

Implementation facts

  • OpenAI documents sandboxing, approval policies, network controls, logs, and telemetry as separate safety controls.
  • Cursor documents self-hosted machines where tool execution runs on user-managed infrastructure while the agent loop remains managed by Cursor.
  • Cursor Projects is rolling out in beta with persistent project context, a coordinator that delegates to subagents, cloud execution, local-agent testing, and schedule or event subscriptions.
  • Cursor names Vercel and E2B among supported execution providers; its self-hosted-machine changelog also names Daytona.
  • A sandbox limits classes of access; it is not evidence that a particular generated change is correct.
  • Vercel's AI SDK harness layer supports native subscription authentication where the underlying harness supports it, with credentials resolved and refreshed at the host boundary.
  • AWS documents a hosted AgentCore Identity Consent Portal for end-user consent before an agent accesses downstream resources, attached to one AgentCore Gateway and its OIDC/OAuth2 identity boundary.

Instruction boundary is not enforcement boundary

A prompt or system instruction says what the agent should do. Filesystem isolation, network policy, scoped credentials, secret handling, tool permissions, sandbox lifecycle, and approval gates determine what it can actually do. Review and test those controls independently.

Managed loop, user-managed execution

Cursor's self-hosted model separates its agent loop from the machine that clones code, runs tools, and produces build outputs. That can keep code and secrets on controlled infrastructure, but prompts, planning context, tool-call requests, results, transcripts, and telemetry still need a documented boundary review.

Harness authentication and the host boundary

Vercel documents direct, auto, and ai-gateway authentication modes for its AI SDK harness layer. Direct mode prefers explicit provider environment credentials and otherwise uses a native subscription found on the host; auto follows that behavior only when AI Gateway credentials are absent; ai-gateway never reads native subscriptions. Tokens are resolved and refreshed on the host, and compatible sandboxes can receive placeholders while the host injects the real token into outbound requests. This reduces exposure in that documented path but is not a universal isolation guarantee.

Execution approval versus delegated-access consent

AWS's hosted AgentCore Identity Consent Portal authenticates an end user to an OIDC provider and gathers consent before an agent accesses a downstream resource on that user's behalf. Each portal attaches to one AgentCore Gateway and uses an OAuth2 credential provider for the same identity provider trusted by the gateway's JWT authorizer; AWS states that the OAuth flow remains server-side and the browser never holds a token. This is an AgentCore Gateway consent path, not a universal delegated-authorization standard.

A sandbox does not review the patch

Isolation can reduce exposure while the agent works. Correctness still depends on the requested change, repository policy, review, and executable tests.

Decision detail

  1. Default to the least access that still permits the task.
  2. Compare persistent context, cloud execution, local/cloud handoff, triggers, schedules, PR lifecycle, and verification—not editor familiarity alone.
  3. Separate network permission from filesystem permission and make escalation visible.
  4. Retain change review and task-specific tests after the agent completes.
  5. Test the denied and escalation paths, not only the successful task path.
  6. Choose the harness, sandbox, authentication mode, and host credential boundary separately; verify native-subscription support for the selected harness and deployment.
  7. Separate execution approval from delegated-access consent: OAuth consent does not approve every future tool action.

Evidence

These claims are source-verified. We do not label this page hands-on or benchmarked because no reproducible test artifact is attached.

Continue the decision