Salambo separates trusted orchestration from customer-authored execution.

Trust boundaries

ActorCan accessCannot access
Trusted hosted runtimeDeployment metadata, provider APIs and sandbox controlDoes not execute customer shell commands or extension code
Hosted extensionDeclared resources and the sandbox workspaceHosted runtime memory or undeclared provider credentials
Managed tool commandWritable /workspace, projected skills and selected toolsPlatform-owned runtime files and control credentials
Checkpoint serviceMutable workspace through a scoped transfer capabilityHosted runtime memory or unrelated workspace data

Workspace isolation

Managed file and terminal tools receive:
  • writable /workspace;
  • read-only projected skills;
  • selected read-only runtime tools;
  • isolated temporary and process namespaces;
  • managed egress configuration.
Platform-owned runtime files and control credentials are not mounted into the managed tool boundary. Workspace symlinks do not bypass this rule.

Extension isolation

Extensions run in the sandbox extension host. The host receives only the declared extension resources, supported event data, tool arguments, and bounded external integration context. The boundary validates message shape, size, deadlines, and results. A malformed response, timeout, or extension error fails the active operation and produces sanitized diagnostics.

Secret and network boundaries

Use exposeTo to choose whether a value belongs in the trusted runtime or sandbox. Sandbox-exposed secrets require explicit destination hosts. The managed sandbox receives a time-limited sealed placeholder instead of the plaintext secret. Salambo opens that placeholder only at the managed outbound proxy after validating the run, destination, network policy, host scope, and expiry. Secrets must not appear in source, logs, diagnostics, workspace files, or artifacts. Continue with sandbox security architecture for the complete request flow and environment variables and secrets for configuration.

Managed images

Managed images use the platform security and compatibility contract. Unsupported isolation capabilities fail closed instead of falling back to direct customer-code execution.