# Combining an agent sandbox with an action gateway

Source page: https://www.finogeeks.com/en/knowledge/agent-sandbox-and-action-gateway
Language: en

FinSAFE constrains execution environments. FinGuard governs business actions, checking whether a specific change may proceed.

## Process access and business changes need different controls

Reading local files, running commands and connecting to networks require process-level boundaries. Updating CRM, submitting tickets and calling write APIs also require business authorization, approval and duplicate-request handling. One permission switch does not address both concerns.

## FinSAFE constrains process execution

FinSAFE applies policies to files, commands, tools, networks and runtime resources, with execution records. Enterprises can define working directories, network access and resource limits as part of a shared security policy.

## FinGuard governs changes to business systems

FinGuard manages business credentials, authorization and human approval. Its idempotency ledger, retry budgets, circuit breaking and hash-chain audit records govern writes. It can be deployed independently of FinSAFE.

- The gateway holds credentials accepted by the target system; agents use gateway-scoped identities.

- High-risk actions wait for human approval after checks.

- Duplicate requests return stored results; uncertain outcomes are checked before retrying.

- Network allowlists can constrain destinations when a mandatory gateway path is required.

## Related products and solutions

Explore the product mechanisms and application details behind this guide.

- FinSAFE

- FinGuard

- FinDesk

## Related resources

- [View all guides](https://www.finogeeks.com/en/knowledge)