Generated code is untrusted input by nature
Whether an agent wrote it or fetched it, code that hasn't been reviewed by a human carries the same risk as any other untrusted content.
By risk
Let the agent run the code. Don't let it leave the box.
Generated code and tool calls are inherently untrusted input. A sandbox is the control that still holds even when an injection attempt fully succeeds-because containment doesn't depend on the attack being detected first.
Why it matters
The last line of defense that doesn't depend on detection
A sandbox survives a successful injection
Detection can fail. Containment doesn't rely on catching the attack-it limits what a fully successful one can reach.
Containment has to be default, not opt-in
A sandbox that teams have to remember to turn on for each new workflow is a sandbox that eventually gets skipped.
What Lineation does
An execution boundary an agent can't talk its way out of
Isolated execution environments
Untrusted code and tool calls run in a boundary separate from production systems and data by default.
Network & filesystem egress controls
Outbound network and file access are denied by default inside the sandbox, allow-listed explicitly where needed.
Resource limits per execution
Time, memory, and spend are capped per execution, so no single run can consume unbounded resources.
Full activity capture
Every call, output, and side effect inside the sandbox is logged for review before anything is promoted.
How it works
Five steps to contained execution
Route untrusted execution
Generated code and tool calls are directed into the isolated environment automatically.
Apply egress policy
Network and filesystem access inside the sandbox follow a default-deny allow-list.
Cap resource use
Time, memory, and spend limits bound what any single execution can consume.
Capture side effects
Stdout, calls, and outputs are recorded for the audit trail as they happen.
Promote reviewed actions
Only actions that pass review or an allow-listed policy run outside the sandbox.
FAQ
Common questions
What counts as untrusted enough to require sandboxing?
Agent-generated code, tool calls triggered by content the agent read, and any action reachable from untrusted input should run inside the sandbox by default.
Does sandboxing add meaningful latency?
The environment is provisioned ahead of need and reused where safe, keeping added latency minimal relative to the model call itself.
Can a sandboxed agent still access the data it needs?
Yes-sandboxing constrains what an execution can reach, not whether the agent can complete its task. Allow-listed data and endpoints remain available.
How is this different from a container runtime we already use?
Agent sandboxing adds policy specific to agentic risk-default egress denial, per-execution spend caps, and full activity capture for the audit trail.
What happens if code tries to exfiltrate data?
Network egress is denied by default inside the sandbox, so the attempt is blocked at the boundary and logged.
Does this work for agent-generated code, not just tool calls?
Yes-both route through the same isolated execution boundary before anything is promoted to run outside it.
Contain the blast radius by design.
Isolate untrusted execution before it needs to be caught by anything else.