What Does Your Agent Sandbox Actually Stop? Comparing Three Isolation Tiers

What does your sandbox actually stop? Most teams can answer that question for two layers: the syscall surface and the network policy. Everything above those layers is usually described with a single w