Picking a tier for five real workloads

Pick an isolation tier for one workload

Interactive decision tree — outcomes:

• No sandbox — scope the tool

  There is no unbounded execution here, so isolation is the wrong control. Spend the effort on the previous module’s toolkit: narrow schemas, read-only credentials, parameter caps, allowlists, gates on the irreversible calls. Then re-run this tree the day someone proposes adding a code interpreter “just for edge cases.”

• Process restrictions and hard limits

  A dedicated unprivileged user, a scratch directory, a syscall filter, resource and wall-clock caps. Cheap and appropriate for small trusted-input jobs with nothing worth stealing in reach. Be strict about the premise: the moment real data, secrets, or third-party content appears, this tier is no longer the answer.

• Hardened container, brokered credentials, default-deny egress

  One container per session: non-root, read-only root filesystem, capabilities dropped, seccomp profile, cgroup caps, network default-deny with an allowlist, and any credential held by a broker outside the box rather than injected into it. Accept the residual risk you are carrying — a shared kernel — and write it down.

• Ephemeral microVM or a managed sandbox

  Untrusted content plus real data means you want a virtualization boundary and a lifetime of one session: a microVM created for the task and destroyed after, or a managed equivalent such as AgentCore Code Interpreter or Browser, or a Foundry hosted-agent sandbox. Keep the hygiene rules on top — no ambient credentials, allowlisted egress, minimal mounted data, logs you actually read.

• MicroVM plus a human gate — not autonomous

  Untrusted content, sensitive access, and an irreversible external action in one session is the configuration nobody can currently secure with filtering. Meta’s Agents Rule of Two says as much: with all three properties present, the agent needs human-in-the-loop approval or another dependable validation mechanism. Isolate it, fix the irreversible parameters outside the model, gate the action on a review of real screen or diff state, and keep a kill-switch within reach. Better still, split the session so no single run holds all three.