Sandboxing AI Agents

Enterprises are increasingly focused on sandboxing AI agents for security, but the term 'sandbox' means very different things depending on the type of agent. Local agents — general-purpose, broad-access tools running in a developer's workspace — genuinely benefit from sandboxing due to their unrestricted access to files, CLI, and networks. Shared (managed) agents, however, are purpose-built for specific tasks and should be decomposed into the agent harness (the LLM reasoning layer) and the tools it calls (web services). Since LLMs themselves cannot interact with the world, the real security surface is the tools. These tools are essentially web services and can be secured using existing controls: authentication, authorization, rate limiting, observability, and least-privilege policies. Major platforms like AWS Bedrock, Azure Container Apps, and Anthropic's managed agents all follow this brain/hands separation pattern. The conclusion is that enterprises should apply standard web service security practices to shared agent tools rather than chasing a specialized 'sandbox' concept that adds little beyond what modern PaaS platforms already provide.