# Sandbox boundaries: source and decision dossier

**Checked 2026-09-15.** Supports [C2: What does your agent's sandbox actually contain?](https://rethinkingagents.com/blog/what-your-sandbox-contains). This is reusable architectural research, not a configuration audit. No implementation, exploit, containment probe or performance measurement was executed for this article.

## Bibliography and bounded observations

### SB01 — Historical account; separate local and cloud contexts

- **Authors:** David Dworken and Oliver Weller-Davies; Anthropic.
- **Title:** *Beyond permission prompts: making Claude Code more secure and autonomous*.
- **Published:** 2025-10-20. Historical engineering report; no release identifier supplied for these claims.
- **URL:** [Anthropic engineering account](https://www.anthropic.com/engineering/claude-code-sandboxing).
- **Date checked:** 2026-09-15.
- **Sections inspected:** “Sandboxed bash tool: safe bash execution without permission prompts”; “Claude Code on the web: running Claude Code securely in the cloud.”
- **Direct observation:** The report describes distinct local containment and cloud Git mediation designs.
- **Source character:** Primary vendor description, not independent reproduction.
- **Confidence:** High that the source states these designs; medium for externally unverified operation.
- **Limits:** Historical description cannot establish current defaults, complete cloud operation policy, data inspection or enforcement across every available tool. Reported internal productivity percentages are deliberately unused.
- **Decision affected:** Keep the article's two diagrams separate; never infer the cloud credential arrangement for a local session.
- **Refresh trigger:** Before any setup guidance, present-tense product guarantee, detailed operation restriction or quantitative benefit claim.

### SB02 — Current local product documentation

- **Organization:** Anthropic / Claude Code documentation; no individual author identified.
- **Title:** *Configure the sandboxed Bash tool*.
- **Publication/version:** Undated live documentation, containing multiple version-specific notes; no pinned release snapshot established. Date checked is not a publication date.
- **URL:** [Local sandbox documentation](https://code.claude.com/docs/en/sandboxing).
- **Date checked:** 2026-09-15.
- **Sections inspected:** “Filesystem isolation”; “Scope”; “The unsandboxed retry escape hatch”; “Protect credentials”; “Security limitations.”
- **Direct observation:** Documents different read/write defaults, inherited environment and separate tool scopes. Exceptions require inspection.
- **Source character:** Primary documentation; observed text does not establish any user's installed configuration.
- **Confidence:** High for inspected text; deployment confidence unknown.
- **Limits:** We did not resolve effective settings, inspect installed versions, verify platform enforcement or follow every exception path. The article intentionally provides no commands or compatibility prescription.
- **Decision affected:** Treat confidentiality, write protection and tool coverage separately. Do not equate a read-only mount with inaccessible data.
- **Refresh trigger:** Before publication if documentation changes; always before recommending a concrete local configuration. Record actual version and effective settings for any subsequent test.

### SB03 — Runtime implementation reference

- **Organization:** Anthropic, `anthropics/sandbox-runtime` maintainers.
- **Title:** *sandbox-runtime*, repository README.
- **Publication/version:** README at commit `d7c44957a8fd8c3ef9acb0ced60ea80916d20bd6`, dated 2026-09-10T00:04:43Z in repository commit metadata. This pins the inspected text, not a bundled client release.
- **URL:** [Immutable README](https://github.com/anthropics/sandbox-runtime/blob/d7c44957a8fd8c3ef9acb0ced60ea80916d20bd6/README.md); [commit record](https://github.com/anthropics/sandbox-runtime/commit/d7c44957a8fd8c3ef9acb0ced60ea80916d20bd6).
- **Original historical link:** [Experimental repository URL](https://github.com/anthropic-experimental/sandbox-runtime) redirects to [the current repository](https://github.com/anthropics/sandbox-runtime).
- **Date checked:** 2026-09-15.
- **Sections inspected:** “Filesystem Configuration”; “Security Limitations”; “Advanced: Bring Your Own Proxy.”
- **Direct observation:** Describes distinct filesystem policies and domain-filtering limitations. Repository caveats are more qualified than a blanket containment claim.
- **Source character:** Primary project documentation, not a source-code audit.
- **Confidence:** High for README contents; unknown for applicability to a bundled client version.
- **Limits:** Runtime capability, embedding configuration and cloud service policy are separate questions. No inference that installing this runtime supplies the cloud Git proxy. No platform-specific instructions reused.
- **Decision affected:** Account for allowed destinations and credential authority after machine containment.
- **Refresh trigger:** Before implementation: identify the installed release/commit, inspect relevant enforcement code and client integration, and check current advisories separately. The documentation pin does not establish the installed version.

## What our analysis adds

These are RA deductions from explicitly stated policies, not reported product results:

| ID | Conditional claim | Reasoning and limitation | Decision consequence |
|---|---|---|---|
| SBA01 | A write restriction alone cannot establish that a file is unreadable | Reading and modification are different operations; other protections may separately deny reads | Record both permissions for each sensitive resource |
| SBA02 | Denying a new read cannot erase information already in context | The data may have entered before the boundary was established | Inventory session inputs as well as filesystem paths |
| SBA03 | A permitted destination can carry inappropriate content | Destination, operation and payload are separate policy dimensions | Inspect actual audience and transfer when disclosure matters |
| SBA04 | Keeping the downstream credential outside execution does not remove all callable authority | A mediated operation remains available by design | Review the intermediary's allowed operations |
| SBA05 | Reviewing one diff need not review the entire transfer | The transfer may include other commits/artifacts or change after review | Establish exactly which artifact is approved and sent |
| SBA06 | Restricting a task to one repository can make legitimate cross-repository work impossible | A control can remove necessary inputs as well as unnecessary access | State the useful task a restriction must preserve |

Confidence is high in these logical distinctions under their assumptions, not in whether any current implementation admits the described path. None establishes a newly discovered vulnerability.

## Unknowns requiring implementation evidence

- Actual client/runtime version, settings provenance and effective policy.
- Reachable tools beyond the sandboxed process and data already in its context.
- Environment credentials, sockets, mounts and exception paths in a selected deployment.
- Exact current cloud Git checks, all permitted operations, credential lifetime and any payload policy.
- How a reviewed artifact is bound to a remote transfer.
- Whether the useful parser task completes under the chosen restrictions, with what interruption and review cost.

Further desk research can resolve documented settings and interfaces. Actual enforcement and task completion require a separately authorized, versioned test with synthetic data. No evaluator expansion follows from this dossier.

## Editorial constraints and reuse

Keep diagram 1 local and diagram 2 historical cloud. Do not combine them into an imagined deployment. Retain the date on the cloud description. Neither a vendor's broad safety language nor the existence of a proxy establishes complete protection.

Paraphrase from each individual webpage is intentionally compact across this dossier and the article; most article content is original conditional analysis. Reuse by linking these entries rather than accumulating another source summary. No source text, screenshot or repository download is committed. No direct quotations are used apart from bibliographic titles and section names.