Reference/Safety
Sandboxes, allowlists, and exec
Path allowlists, host allowlists, tiny builtins, blocklists as defense-in-depth — not as the only wall.
Autonomy without a sandbox is a privileged confused deputy.
Allowlists beat blocklists
| Surface | Allowlist |
|---|---|
| Tools | registry keys |
| Paths | src/fizzbuzz.py not tests/ |
| Hosts | example.com |
| Hypotheses | runbook keys |
| HTTP methods | GET vs POST |
Blocklists (__import__, drop table) catch accidents. They do not catch getattr(__builtins__, "o"+"pen").
exec in class
The multi-agent oracle may exec a fizzbuzz stub with:
{"__builtins__": {"range": range, "str": str, "int": int}}
That is not a security boundary. Do not exec live-LLM code on a laptop with secrets. Use a VM, gVisor, or "no exec, only AST of a tiny language."
Files as dicts
Joeven stores repos as dict[path, text]. There is no real filesystem in Try it. When you move to disk: chroot, worktree, max bytes, no ...
Network
No urllib in classroom agents. Simulated dicts. Production: SSRF allowlist, size cap, timeout, no file://.
Checklist before a demo
- [ ] Mutate gated
- [ ] Tests / metrics not writable by the model
- [ ] Secrets redacted
- [ ] max_steps / max_usd
- [ ] Audit log
- [ ] Eval that forbids the scary path
Watch out:Removing the gate "just for the demo" is the incident.