# Agent sandbox Protect systems, data and networks Source page: https://www.finogeeks.com/en/products/agent-security Language: en FinSAFE provides isolated sandboxes for agent code and tool execution. It controls system operations, file access, network connections and resource use, keeping tasks within authorized boundaries with centralized management and traceability. ## Local desktop sandbox • Local data and tools ## Server-side sandbox • Tasks and codes - File Permissions - Tools - Network - Resource control ## Define clear boundaries for agent execution Enterprises and users define the files, tools and network destinations agents may access. FinSAFE enforces these permissions during execution through operating-system isolation and access checks. Documentation ### File access permissions Set directory-level read, write and deny rules for files on employee devices or servers. Implementation ### Command and tool execution Run tools and code inside a sandbox, applying permissions to commands, scripts and their child processes. Network ### Network access controls Allowlist model and business-service domains to restrict unauthorized connections. Resources ### Task and resource management Set task counts, concurrency and resource limits, and manage queues and abnormal execution. ## Separate everyday work from system-level operations Editing files, installing dependencies and troubleshooting can affect system settings. FinSAFE separates normal work from protected operations and checks permission changes, system configuration and access to critical processes. | Protected Operations | Possible impact | Control focus | | --- | --- | --- | | Permissions and Owners | The file or procedure cannot be accessed, or the scope of the visit extended | Check object privileges and owner changes | | Registration form and startup settings | Programs are running abnormally, seriously affecting Windows startup | Check access to registration forms, protected files and system management interfaces | | Processes and services | Critical process exit or disruption of business services | Check process handles and service privileges | | Accounts, tasks and start-ups | Add High Permission Account or Ongoing Entry | Check account management, plan tasks and start-up interface | | Network and security settings | Network connections abnormally or system protection weakened | Checking access to network and security settings | | Original Disk Writing | Damage to partition or file system | Check original device write permissions | #### Limit Memory Usage Limit the memory of agent and their tool sub-processes to reduce the impact on other jobs and shared services of staff. #### Limit the number of processes Control of the number of processes initiated by agent and tools to avoid the continuous process of task generation and the diversion of system resources. #### Timeout and Cleanup In the execution path that supports time control, the task is terminated and its process tree is cleaned up after time. ## Protect enterprise data with clear agent access boundaries Define which files agents may read or modify before execution. Set read/write, read-only and blocked directories to protect data from unintended actions. | Contents | Permissions | Allowed Operations | Use | | --- | --- | --- | --- | | D:\Work Item | Readable and Writeable | Create, read, modify, delete, rename and move | Finish Tasks and Save Results | | D: \\references | Read-only | Listing, reading and searching | Access to systems, norms and reference documents | | D: ·Personal information | Ban Access | Can not list, read or write | Protection of information not relevant to the current mandate | ### Control data destinations and handle sensitive requests by policy Define the model and business services each task may reach. Inspect supported requests for sensitive data, then alert, block or request one-time approval according to policy, retaining the outcome. #### Keep sending after the alarm. Recording sensitive information and alerting, keeping relevant processing records and requesting continued transmission. #### Stop this request. Stop sending after the strike breaks the rules and record the trigger cause and the outcome of the treatment. #### Pending single approval (a) To suspend the request pending its approval; Can not delete folder: %s: No such folder ## Lightweight isolation, centralized control and traceability Create process-level sandboxes for individual tool calls or conversational tasks using native operating-system permissions and isolation. Tools run in the designated environment, which is cleaned up after completion while records are retained, reducing per-agent environment maintenance. ### Execute inside the sandbox Limit files, commands, networks and resources ### Isolate agent processes Isolate tools and code with their child processes, controlling file, network and resource access. ### Preserve familiar Windows workflows Run existing Windows programs with your current tools and authorized file paths, without a separate VM for every agent or a migration to Linux. ### Reuse policies and inspection services Reuse permission settings and inspection services, clean up environments after tasks, and retain results and execution records. ## Set permissions centrally and enforce them at execution Responsibilities are clear from policy setup through execution and review. Enterprises define agent permissions, FinSAFE manages the environment, and the operating system enforces access checks. Execution records support everyday review and incident investigation. Enterprise Manager ### Define permissions Define agent access to files, tools, networks and resources, then distribute policies to managed devices. FinSAFE ### Launch and manage by policy Prepare authorization, load policies and launch a controlled environment for tools and their child processes. Operating systems ### Check access as it happens Use native system security to check permissions when accessing files, processes, networks and protected resources. Records management ### Review execution and results Review requests, responses, alerts and approvals. Distinguish complete and interrupted records and trace triggered rules and blocked actions. ## Control execution permissions across desktop assistants and CLI agents Set boundaries for local tool calls from desktop assistants, CLI agents and agent frameworks. Keep familiar interfaces while controlling files, commands, local MCP and network access, with records of execution and blocked actions. ### Desktop assistants - WorkBuddy - Bean buns. - Question. For documentation, document processing and day-to-day operations, deploy implementation rules when assistants call on their own tools, limit accessible information and tools, and maintain work portals that are familiar to staff. ### CLI agents - DSH - Codex - Claude For development, IT operations and automation, manage shell, Python, Node and git tools together with their child processes, file permissions and resource limits. ### Agent frameworks - AgentScope - DeerFlow Through the executive interface, code, script and tool tasks in the framework of AgentScope, DeerFlow are entered into the sandbox, with execution privileges according to business configuration and centralized viewing of records. WorkBuddy Naughty Program ### Add execution boundaries to existing AI assistants Take the example of WorkBuddy, and start with the helper's own tool, planning documents, commands, local MCP access security management. #### _Other Organiser Maintain existing assistants to interact with official models, deploy security rules at the tool implementation link and allow staff to continue to use familiar office patterns. #### Harmonization of management tool privileges Sets access rights, resource usage and process running rules around tool paths such as shell, PowerShell, Python, Git and local MCP. #### Uniform marks of execution and interception The results of document operations, tool start-up, access to objectives and rules processing are included in the audit to facilitate enterprise traffic and internal audit verification. #### Update and review configuration In conjunction with the helper version being used by the enterprise to confirm access, the upgrade review tool calls the path, the configuration of the tube and the protective effects. ## Protect employee devices and private-network servers Use local desktop sandboxes, server-side sandboxes or both. Existing endpoint management systems can install clients, register devices and distribute security policies. ### Run on employee devices Process files and run tools locally with defined file and network permissions, retaining business data on employee devices as required. ### Run on private-network servers Provide centrally managed execution environments on enterprise servers or container clusters, including task creation, tenant isolation, resource allocation and cleanup. ### Integrate with endpoint management Use existing systems such as Jamf, Intune and UOS domain management to deploy clients, register devices and verify certificates. ### Deploy on domestic IT platforms Support UOS, Kylin and openEuler with lightweight process isolation and less dependence on large virtualization components. Terminals and Servers UOS ·enEuler Jamf / Intune / UDI ## FinSAFE / Frequently asked questions ### What does FinSAFE control? FinSAFE provides process-level sandboxes controlling system operations, files, tools, networks and resources. Deploy on employee devices and private-network servers to configure policies, handle sensitive requests and review execution records. ### Are all requests containing sensitive data blocked? Enterprise policy decides. A request may continue with an alert, be blocked, or pause for one-time approval. If that approval is cancelled or expires, the request is not sent. ### Does FinSAFE require data to be uploaded to a public cloud? No. FinSAFE runs on enterprise-owned devices and private-network servers. Tasks execute locally, data stays where enterprise policy requires, and the management platform collects execution records. ### Does every agent need a separate virtual machine? No. Native process isolation avoids installing a complete operating system for each agent. Windows runs local programs directly; server deployments can use existing container clusters. ### Which operating systems and endpoint tools are supported? FinSAFE supports Windows, macOS, Linux, UOS, Kylin and openEuler. Existing systems such as Jamf, Intune and UOS domain management can deploy clients and manage devices. ### How does FinSAFE work with endpoint security products? FinSAFE limits what protected agents and tools can do. Existing endpoint security and administrator policies continue to protect and manage the whole device. The products work together; FinSAFE does not replace endpoint security.