Trust boundaries
| Actor | Can access | Cannot access |
|---|---|---|
| Trusted hosted runtime | Deployment metadata, provider APIs and sandbox control | Does not execute customer shell commands or extension code |
| Hosted extension | Declared resources and the sandbox workspace | Hosted runtime memory or undeclared provider credentials |
| Managed tool command | Writable /workspace, projected skills and selected tools | Platform-owned runtime files and control credentials |
| Checkpoint service | Mutable workspace through a scoped transfer capability | Hosted runtime memory or unrelated workspace data |
Workspace isolation
Managed file and terminal tools receive:- writable
/workspace; - read-only projected skills;
- selected read-only runtime tools;
- isolated temporary and process namespaces;
- managed egress configuration.
Extension isolation
Extensions run in the sandbox extension host. The host receives only the declared extension resources, supported event data, tool arguments, and bounded external integration context. The boundary validates message shape, size, deadlines, and results. A malformed response, timeout, or extension error fails the active operation and produces sanitized diagnostics.Secret and network boundaries
UseexposeTo to choose whether a value belongs in the trusted runtime or sandbox.
Sandbox-exposed secrets require explicit destination hosts. The managed sandbox receives a time-limited sealed placeholder instead of the plaintext secret. Salambo opens that placeholder only at the managed outbound proxy after validating the run, destination, network policy, host scope, and expiry.
Secrets must not appear in source, logs, diagnostics, workspace files, or artifacts.
Continue with sandbox security architecture for the complete request flow and environment variables and secrets for configuration.