Sandboxing alone is not enough for secure AI agent architecture

At a glance

What this is: This is an architecture analysis showing why AI agent sandboxing is necessary but insufficient, and why credential brokering plus behavioral authorization are required to bound damage and keep actions attributable.

Why it matters: It matters because IAM, PAM, and NHI teams have to govern the agent's delegated authority, not just its execution environment, or they will miss the paths that turn permitted steps into harmful outcomes.

Context

AI agent security fails when teams treat process containment as if it were the whole control model. A sandbox limits what the agent process can touch, but it does not by itself govern delegated authority, network egress, or whether a sequence of individually allowed actions becomes unsafe.

The governance gap is broader than classical least privilege because the agent can keep acting after each step looks authorised in isolation. That is why agentic AI identity has to be treated as an end-to-end lifecycle problem, not a single permissioning decision.

This article is therefore about architecture, not just hardening. It separates containment, brokered authority, and runtime judgment so practitioners can see which failure mode each layer addresses and which one it still leaves open.

Key questions

Q: What fails when AI agents are sandboxed but still have network access?

A: The sandbox still limits process reach, but the dangerous path remains when allowed repository access combines with allowed egress. In that case, no single permission looks wrong, yet the sequence creates a route for data movement or misuse. Teams need a control that evaluates the chain of actions, not only each action in isolation.

Q: Why do brokered credentials reduce AI agent risk without solving it completely?

A: Brokered credentials remove standing secrets from the agent and narrow the blast radius, but they do not automatically decide whether the next request belongs in the current session. A short-lived token can still be replayed, and a valid grant can still support a harmful sequence. The remaining problem is contextual authorisation, not credential issuance alone.

Q: How do you know if AI agent authorization is actually working?

A: Authorization is working when each agent action can be tied to a current identity, a current policy, and a specific data or resource scope. If access reviews cannot explain who approved the entitlement, or logs cannot reconstruct the decision, the control is not operationally effective.

Q: What is the difference between human consent and runtime authorisation for agents?

A: Human consent is the initial approval to let an agent act, while runtime authorisation is the live decision that a specific action is allowed now. For agents, the distinction matters because the original approval can be valid and still insufficient once context, target system or scope changes during execution.

Technical breakdown

What a sandbox actually controls in an AI agent runtime

A sandbox is a containment boundary, not a complete security architecture. It can deny by default within the resources it mediates, but it only protects what it is configured to cover and what the operating system, hypervisor, or gateway can truly enforce. In agent systems, that means filesystem access, child processes, network calls, and other mediated resources may be bounded, yet the sandbox still cannot decide whether a sequence of permitted actions is appropriate. The key distinction is between blocking an operation and governing an outcome. A process can remain fully contained and still read data, combine it with allowed internet access, and produce an unauthorized result. See the Agentic AI Security Guide.

Practical implication: Treat sandboxing as a containment layer, not the final authorisation decision for AI agents.

Why brokered credentials reduce but do not remove agent risk

Brokered credentials move standing secrets out of the agent and replace them with short-lived, scoped authority issued through an identity-aware path. That reduces blast radius because the agent no longer holds durable upstream secrets, and it improves attribution because the broker can record which identity received which grant. But the model still has limits. A broker that only checks identity and scope does not necessarily know whether a later action fits the session's trajectory, and an issued bearer token can still be replayed until expiry if the resource does not bind it tightly enough. The control improves delegation, but it does not make the agent's next move semantically safe on its own. See the AI Agent Authorisation Guide.

Practical implication: Use brokered credentials to remove standing secrets, then verify that issuance policy and token binding limit reuse.

How contextual authorisation closes the sequence problem

Contextual authorisation evaluates the proposed action against the current session, not just against static role or scope metadata. That matters because the dangerous object in agent security is often the sequence, not the individual call. An action that looks acceptable in isolation can become risky when it follows a sensitive read, a tool hop, or a network egress decision. Runtime policy therefore needs session history, request parameters, and an enforcement point that the agent cannot bypass. Deterministic rules handle hard boundaries, while semantic evaluation can add risk signals for ambiguous cases. The important point is that the decision must happen before execution, with evidence preserved for later review. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Insert pre-execution policy checks that evaluate session context before the agent can complete the next tool call.

Threat narrative

Attacker objective: The objective is to turn authorised agent capabilities into an unauthorised data-exfiltration or system-manipulation path without triggering a traditional access-control failure.

1. Entry occurs through legitimate AI agent access to internal systems, external APIs, or networked tools that were already permitted by design.
2. Escalation happens when individually allowed actions are composed into an unauthorized sequence, such as reading sensitive data and then using allowed egress to move it out.
3. Impact follows when the agent's standing authority, exposed context, or shared infrastructure lets the sequence complete without a human review point.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Sandboxing is a containment control, not an identity control: It bounds process reach, but it does not decide whether a sequence of permitted actions is legitimate. In agent systems, that means the most dangerous failure mode is often authorised composition, not unauthorised entry. Practitioners should stop treating process isolation as a proxy for governance.

Brokered credentials change the blast radius, not the trust model: Moving standing secrets out of the agent reduces the value of compromise, but it does not remove the need to judge whether the agent should receive the next grant. The security question shifts from where the secret lives to whether issuance policy and delegation evidence are sufficient for the session.

Contextual authorisation is the missing control plane for agentic behaviour: Static access models assume a stable request, yet agents create multi-step trajectories that only make sense in context. That is why a runtime decision layer is now part of identity governance, not just application security. The practitioner conclusion is to govern the action chain, not the individual call.

Authorized-step composition is the new identity blast radius: The article's central lesson is that risk now accumulates across allowed steps, shared services, and permitted egress. This is why the relevant control question is no longer only who can authenticate, but what the agent can do next, given everything it has already done.

Assumption collapse is the real change here: Least privilege was designed for actors whose intent could be approximated at provisioning time. That assumption fails when an AI agent can plan, sequence, and execute multiple tool calls after the grant is issued. The implication is that identity governance must move from static entitlement review toward runtime decisioning.

Read next: Agentic AI Identity Guide

What this signals

The next maturity step for agent security is not broader sandboxing alone, but governance that can reason over delegated authority and action sequences. Programmes that still evaluate each tool call as an isolated event will miss the compound risk that this architecture exposes.

Authorized-step composition: This is the control gap that matters most when agents can chain legitimate actions into an unsafe outcome. The practical shift is from static permission review toward runtime judgment that can see the session as a whole.

For practitioners

• Separate containment from authority Keep sandbox policy, credential issuance, and runtime decisioning in different enforcement layers so one control failure does not expose the full environment.
• Remove standing secrets from agent processes Replace durable API keys and tokens with short-lived delegated credentials issued outside the agent boundary, and validate that the resource can bind each grant to the intended request.
• Mediate outbound egress explicitly Force agent internet and API traffic through an unavoidable gateway so repository reads, uploaded content, and external calls cannot combine into an unchecked exfiltration path.
• Gate the next action on session context Require pre-execution checks that consider what the agent has already read, requested, or uploaded before allowing the next tool call to proceed.
• Test failure handling before rollout Simulate expired tokens, denied actions, policy-engine outages, and unexpected resource use so the platform proves it can fail closed and preserve evidence.

Key takeaways

• AI agent sandboxes are necessary for containment, but they do not by themselves govern delegated authority or action sequences.
• Brokered credentials reduce standing-secret exposure, yet the remaining risk is whether each next action still fits the session.
• Practitioners need runtime authorisation that evaluates context before execution, or authorised steps can still produce unauthorised outcomes.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide · AI Agent Authorisation Guide · Agentic AI Security Guide

Key terms

• Sandbox: A sandbox is a controlled execution environment that isolates an agent's runtime from the rest of the estate while still allowing defined actions and tool use. For identity teams, the sandbox is part of the trust boundary because it carries the agent's access, state, and audit trail.
• Brokered Credential: A brokered credential is a secret held by an enforcement layer and injected only when a specific action is authorised. This keeps reusable credentials out of the agent runtime, which reduces exposure to prompt injection, context leakage, and direct secret reuse.
• Contextual authorization: A policy approach that evaluates access using real-time signals such as task, location, device posture, and time. It is more precise than static role assignment because it matches how autonomous agents operate, where intent and risk can change across a single workflow.
• Authorized-Step Composition: Authorized-step composition is the failure mode where individually permitted actions combine into an unsafe outcome. It matters for agentic systems because security can break even when each step appears valid, which means governance has to evaluate the whole sequence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM, PAM, or identity governance programme, it is worth exploring.