Secure AI agents: sandbox, permissions and a human in the loop

Alexander Krastev · 2026-10-19

An AI agent that can send e-mail, move money or delete files is only as safe as the limits around it. Instructions in a prompt are not limits — a model can be talked out of them. Real AI agent guardrails live in code. These are the ones AIK enforces.

1. A human in the loop, on by default

Every new agent has ask before acting switched on. Actions that leave the system — sending an e-mail or message, uploading, posting, paying, deleting, writing to a database — are parked on the dashboard with exactly what the agent wants to do. Nothing happens until a person presses OK. Reading and preparing are free; acting waits.

2. Permissions: who it may write to, where it may go

Each agent can have an allow-list of recipients and web addresses. An e-mail to an address not on the list, or a page outside the allowed sites, is refused — whatever the model decided.

3. A sandbox for its tools — on Linux and Windows

On your own server the agent's tools can run fenced: on Linux in a bubblewrap sandbox, on Windows in an AppContainer. Either way the tools see only that user's own files — not AIK itself, not other users, not the operating system. Folders outside AIK are opened only when a person names them, and system folders and whole drives are always refused.

4. Money limits

Every run is priced on the model it used, and a monthly budget per agent stops it at the limit — scheduled and e-mail-triggered runs included, not just the ones a person starts.

5. Proof of what happened

Every action goes into an append-only activity log whose entries are chained by hashes, so a change after the fact shows. Each run keeps its steps, the model it used and its cost.

6. Honest output

Anything AI produced that leaves — e-mails, messages, documents, posts, videos — carries a mark that it is AI-generated, visibly and inside the file, as the EU AI Act expects.

Test before trust

A new workflow can be test-run: every action is held and listed instead of executed, so you see what it would do. It is switched on only when a person decides.

More: custom tools for AI agents · GDPR compliant AI automation · security.