A raw shell is a footgun
Give an agent a raw shell string and one injected character can turn a read into a delete. The sandbox removes that class of problem by design.
Argv, not a string
Commands are built as argument lists, never as a single shell line to parse. That closes the classic injection hole where a filename becomes a command.
The boundaries
- An allowlist of permitted commands.
- A workspace folder the agent cannot leave.
- Deletes that go to the trash.
- Always-blocked patterns: sudo, rm -rf /, pipe-to-shell downloads.
Secure mode
For the strictest cases, secure mode is read-only, workspace-only, and network-free. It cannot be loosened by any prompt.
The local policy wins
Whatever the dashboard allows, the policy file on the device is the final authority. A cloud setting cannot override the machine owner.