Sandboxes do not work for corporate AI agents

We are building the next Domestique, an endpoint agent for AI tools in the corporate environment. People ask why we do not sandbox the agents. Our answer: in a company, a sandbox does not work.

The work needs the holes

A useful agent reads the real repository. It uses real credentials. It calls the network, the ticket system and the cloud console. Each of those is a hole in the sandbox.

Cut the holes and the sandbox allows everything the agent needs. It is no longer a sandbox. It is a normal process with a label.

Keep the walls and the agent cannot do the job. Developers then run the agent outside the wall. I have never seen a team keep using a tool that blocks its work.

A sandbox sees no intent

Say the sandbox holds. You still learn little. It can tell you the agent opened a socket. It cannot tell you the agent sent a customer record in a prompt, or why. It records no intent and no data. An auditor asks what left the company, and the sandbox has no answer.

Decide at the point of use

Our open-source firewall sits on the request path. It scans the actual prompt, redacts secrets, and forwards the clean version with the developer's own key. The workflow keeps running. Only the dangerous part changes.

The endpoint agent works the same way for commands. It sees who started a process, judges the real command line, and denies a pipe from a download into a shell before it runs. A normal git status passes without delay. Each decision cites the data it judged and the reason code.

The rule that shaped the design: errors must deny. A parse failure or a detector crash returns block, never allow. One typo must not turn enforcement off.

The strongest objection

A security engineer will say: a sandbox is a hard boundary, and a policy engine is pattern matching that attackers route around. That is correct. Ours has known escapes, and we keep a written list of them.

But a sandbox boundary only holds while it blocks the work. Once it allows the work, the boundary is gone. An incomplete control that reads the real data, fails closed and records every miss beats a complete control that reads nothing.

We do not claim policy enforcement is airtight. We claim it is the only control that still runs after the agent gets the access it needs.