A sandbox is a set of boundaries
An isolated execution environment should limit what a run can affect and what it can observe. Our editorial checklist covers processes, files, credentials, network destinations, browser state, and stored artifacts. A container, virtual machine, or remote browser is an implementation choice. Its name alone does not tell you which of those boundaries are enforced.
Anthropic recommends a dedicated virtual machine or container with minimal privileges for computer use. OpenAI recommends an isolated browser or VM plus restricted sites and actions. Evaluate the actual configuration against the task instead of treating the hosting product as the security policy.
Keep one job from inheriting another
A session that persists cookies is useful for an authorized recurring task, but it also carries identity forward. Decide whether persistence belongs to a user, tenant, workflow, or single run. Never let convenience choose that scope accidentally. A new browser page may still share the same authenticated context.
For a pilot, use a dedicated test account and synthetic records. Give the environment only the working directory it needs. Keep model-service credentials outside the controllable desktop where possible. If a secret must enter the environment, define how it expires and how a completed or failed run removes it.
Constrain exits as well as entry points
A filesystem restriction is incomplete if the process can upload visible files to arbitrary sites. A domain restriction is incomplete if an allowed page can accept arbitrary uploads. Review the action and the destination together. Decide what downloads are allowed, where they go, and which later component is permitted to read them.
Our recommended default is a task-specific network and artifact policy. Record blocked attempts as events without copying secrets into logs. Make the controls testable using a deliberately disallowed destination and a harmless file outside the working directory.
Prove cleanup and recovery
End a run deliberately: export permitted artifacts, record the result, invalidate temporary access, and destroy or reset the environment according to its session policy. Exercise this path after normal completion, an exception, a timeout, and operator cancellation. Cleanup that happens only on success is incomplete.
The acceptance test should show that a following job cannot recover a prior tenant’s cookie or file and that a cancelled job cannot continue acting. Document residual access and persistence as known risks. This guide proposes isolation checks; it does not assert that a listed service passes them or that isolation removes the need for approval at consequential actions.