Explain like I'm five · AI Security

What is a Tool Sandbox?

A tool sandbox, told as a story about a drawer that opens one slot at a time for the apprentice — and locks again when done.

the drawer is wide openFIRE!the apprentice grabs the knife, the flame, the phone — whatever it wants

The apprentice grabs the knife, the flame, the phone — whatever it wants.With the whole drawer open, there's nothing to stop one tool's trouble from spreading.

runs errands alonewill it need just the knife, or the flame too, or the phone — you can't know all of it ahead of timethe manager can't watch every single errandif one tool misbehaves while everything else stays open too, the damage spreads

If one tool misbehaves while everything else stays open too, the damage spreads.The apprentice decides its own next step — which is exactly why things need to be locked down ahead of time.

knifeflamephoneonly one slot openseven an accident stays inside this one slotA Tool Sandbox isolates where a tool runs — so damage stays contained

A tool sandbox isolates where a tool runs — so damage stays contained.Only one slot opens at a time, and even an accident stays inside that one slot.

One slot at a timethe rest stay locked
Opens only for the moment of uselocks again right after
There's a wall between slotsone slot breaking doesn't touch the next
Resets back to lockednext time, one slot again
HOW THE DRAWER WORKS① the apprentice asks for one slot② only that slot opens, rest stay locked③ the tool is used inside that slot only④ the slot locks again when doneknifeflameone slot at a timethe other slots stay locked the whole time

One slot at a time — and it locks again after use.Only the requested slot opens; the rest stay locked the whole time.

knifeflameisolation — where it runsif a slot breaks, it doesn't spread to the whole kitchenknifeflamepermission — what it's allowed to dothat's the next page — a permission badge per toolisolation contains a break; permission decides how much to grant in the first place

Isolation contains a break; permission decides how much to grant in the first place.A sandbox in the security world is the general concept of isolation; this is the version built specifically for isolating a tool call. How much each slot is allowed to do is the next page — a permission badge per tool.

In one breath

Tool sandbox = letting the apprentice use a tool one drawer slot at a time, and locking it again afterward. If one slot breaks, the damage doesn't spread to the others.

A security mechanism that confines an LLM agent's function-call (tool) execution to an isolated environment — a process, container, or dedicated runtime. It restricts access to the filesystem, network, and system resources, so that even if one tool misbehaves or is abused, the damage stays inside that sandbox. It's the general sandboxing concept applied to the specific execution point of a tool call.

When grown-ups say it

Tool Sandbox
A drawer that opens one slot at a time. Even an accident stays inside that one slot.
Sandbox
The general isolation concept from the security world. This page is the version built for a tool call. → What is a Sandbox?
Tool Calling
The apprentice taking a tool out to use it. This is exactly what gets isolated. → What is Tool Calling?
Per-tool Permission
A different badge for each slot. The paired next page. → What is a Per-tool Permission Badge?
Least Privilege
Only what's needed, from the start. Pairs well with isolation for extra safety.
Agent
The apprentice running errands. It runs alone and decides its own next step.
Supply Chain Attack
Tainted ingredients already sitting in the pantry. Even a tool inside the drawer can already be broken from the start.
Incident Response
The bell you ring once an accident happens. Isolation cuts down how often that bell has to ring.
Next story
A Permission Badge Per Tool →
Want another term as a picture book? Request →