{
  "id": "layer:9-sandbox",
  "_kind": "Layer",
  "_file": "stack-layers/layers/layer-9-sandbox.yaml",
  "_cluster": "stack-layers",
  "attributes": {
    "displayName": "Sandbox",
    "position": 9,
    "path": "surfacing",
    "scope": "Policy-enforcement perimeter around execution and side effects.",
    "summary": "The sandbox layer constrains `Execution`: filesystem allow/deny lists,\nnetwork allow/deny lists, binary allow/deny lists, environment and secret\nscope, audit-log policy, and policy evaluation point (pre-call,\ncontinuous, or post-call attestation). Coarse posture is captured by\nfilesystemPolicy and networkPolicy enums. Realized by `Sandbox` nodes.\n",
    "responsibilities": [
      "Enforce filesystem, network, binary, secret, and environment policy.",
      "Record audit evidence and policy decisions around side effects.",
      "Define approval, escalation, and attestation boundaries for execution."
    ],
    "examples": [
      "Read-only filesystem, workspace-write mode, network-disabled mode.",
      "Binary allow list, secret scope, approval-required command policy.",
      "Container, VM, OS sandbox, or hosted policy engine."
    ],
    "fitNotes": "Custom-agent frameworks may leave sandboxing entirely to the embedding\nhost. Production tools should model this layer explicitly even when users\nonly see a simple approval prompt.\n"
  },
  "outgoingEdges": [],
  "incomingEdges": [
    {
      "from": "sandbox:codex-read-only",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "sandbox:codex-workspace-write",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "sandbox:codex-danger-full-access",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "sandbox:default-container",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "sandbox:read-only-air-gapped",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "sandbox:permissive-developer",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-orientation",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-builder-fit",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-landscape-diagram",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-placement-checklist",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-worked-examples",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-common-confusions",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-reading-paths",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-comparison-matrix",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-review-template",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-faq",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-layers",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:agent-generate-universal-agentic-stack-source-map",
      "to": "layer:9-sandbox",
      "kind": "documents"
    },
    {
      "from": "page:views-agent-stack-tower",
      "to": "layer:9-sandbox",
      "kind": "documents"
    }
  ]
}