Proposed specificationSource-located exemplarH2

Layered permission and sandbox

Combine policy decisions with execution isolation.

JOIN POINTauthorized_action_environmentRECORD STATUSCandidate · v0.1.0

UML class view

The proposed contract drawn as participant roles, received calls, and numbered dependencies.

Object interactions

The same roles and calls as a class collaboration and a numbered message sequence.

Object interaction diagram for Layered permission and sandbox, showing role collaboration and a numbered message sequence — FIG. P23 / OBJECT INTERACTIONS
Open full SVG Download PDF

Pointcut

Where the mechanism applies. All four dimensions belong to the proposed match, not just its vocabulary.

Context: A tool action is evaluated by policy and executed in a controlled environment.
Trigger: A privileged operation or command is dispatched.
Structure: Authorization decision, sandbox profile, environment adapter, and enforcement point.
Effect: The effective capability equals the authorized capability, including filesystem and network.

Protected contract

The obligation that clients, operators, and auditors should be able to rely on.

Requires: Requested operation and active environment policy are both observable.
Ensures: Any difference between approval and enforcement fails closed or asks for escalation.
Invariant: A policy decision cannot be bypassed by switching sandbox or transport backend.
Violation: Enforcement errors deny execution and preserve actionable diagnostics.

Negative control

A prompt warning without execution enforcement is not a sandbox.

Variation & lifecycle

The hot spot is admitted only where the protected semantics survive.

Permitted variation

OS sandbox, container, mount policy, network rules, and approval mode.

Test obligation

Test each backend, denied write/network, cross-backend parity, and escape attempts.

Evolution question

Did one policy surface evolve into layered cross-platform enforcement?

Prompt + code design

An illustrative prompt and a small design sketch for the proposed contract. Names and APIs are invented; this is not a repository excerpt.

PROMPT SKETCH

Check the approved operation against the environment that will enforce it. If approval and enforcement differ, fail closed or request escalation; never run with less isolation than the approval assumed.

CODE DESIGN / PYTHON

def verify_enforcement(request, approval, sandbox):
    effective = sandbox.describe(request.action)
    if not approval.covers(effective):
        return Escalation(
            reason="approval/enforcement mismatch",
            approved=approval.scope,
            enforced=effective,
        )
    return sandbox.execute(request.action)

Illustrative design sketch. The sandbox is the enforcement evidence; the approval prompt is only intent. This example is a teaching aid, not implementation evidence or a conformance claim.

Detection & matching

The frozen rule that retrieves this record, the canonical source exemplar, and the control that should stay unmatched.

Join point: authorized_action_environment
Source locator: Barbaste et al., §10.1, p. 35 (Claude Code, “Three-Layered Permission System”); §10.2, p. 36 (Codex permission stack with native sandboxing); merged label
Lexical cue: (?i)\b(?:sandbox|container|permission[_-]?profile|policy[_-]?engine)\bFrozen expression, v0.1.0. A match is a retrieval cue, not a confirmed implementation.
Aliases: None
Canonical exemplar: openai/openai-agents-pythonsrc/agents/sandbox/sandbox_agent.py:31Support: tests/sandbox/test_mount_security.py:1
Negative control: A prompt warning without execution enforcement is not a sandbox.

Scope-anchored review. pohe-agent analyze <repo> --pattern P23 anchors the cue to its enclosing declaration and checks a separate operational signature for all four pointcut dimensions. Missing roles and negative-control risks remain visible; a structural match is not E2/E3. Calibration report ↗

Repository files

Up to five public files retrieved by the frozen cue and pinned to the audited commit. A match is a place to inspect, not a confirmed implementation.

01openai/openai-agents-pythonsrc/agents/sandbox/sandbox_agent.py:31CANONICAL SOURCE 02aaif-goose/goosecrates/goose/src/acp/provider.rs:4292RETRIEVAL CUE 03affaan-m/ECCskills/council-multi-model/scripts/review-with-codex.js:104RETRIEVAL CUE 04agno-agi/agnolibs/agno/agno/sandbox/base.py:1RETRIEVAL CUE 05Aider-AI/aideraider/coders/editblock_fenced_prompts.py:113RETRIEVAL CUE

Evidence & provenance

Each layer answers a different question. Do not substitute retrieval for review.

Source-located exemplar

A concrete source anchor is available for this proposed record. It is one exemplar, not evidence that all repositories—or every contract field—conform.

Review boundary: this candidate and its specification come from an AI-assisted study. Independent human validation remains open.

ANY-EVIDENCE FAMILY COVERAGE36/36

100.0% of repository families in the frozen panel have at least one current cue, historical cue, or canonical source layer. This is not confirmed prevalence.

Current lexical-cue repositories: 40 / 41

Canonical source anchoropenai/openai-agents-python 86bd29878b30src/agents/sandbox/sandbox_agent.py:31

Supporting surfacetests/sandbox/test_mount_security.py:1

Sandbox-backed agent with approvals and workspace isolation.

Exploratory retrieval cue Regex / v0.1.0

(?i)\b(?:sandbox|container|permission[_-]?profile|policy[_-]?engine)\b

This expression is a discovery instrument only. A match is a retrieval cue—not a confirmed implementation, pointcut match, or contract proof.