Agency Sandboxing: Isolation Protocols for Untrusted Tool Execution in LLMs

ABSTRACT

As LLM agents are granted access to execute code, query databases, and interact with file systems, the risk of catastrophic failure or malicious exploit grows exponentially. We propose 'Agency Sandboxing,' an isolation protocol utilizing MicroVMs and a deterministic Gatekeeper Agent to mediate all third-party tool execution. The framework enforces strict principle-of-least-privilege (PoLP) policies dynamically, evaluating the semantic intent of a tool call against allowed operational boundaries before execution. We demonstrate that Agency Sandboxing effectively mitigates 99% of zero-click sabotage and privilege escalation attacks with sub-200ms overhead.