Applied AI·Agents
the agent runs its shell commands inside a container against a scratch copy, so a bad step cannot touch production.
Sandboxing
Draft summary, pending review
Running agent actions in an isolated environment (a container, a VM, a scratch database clone) so mistakes cannot touch production. Non-negotiable for agents that execute code or shell commands.