The Agent Security Split: Tool Layer vs Sandbox Layer

When an enterprise asks, “Is your agent platform secure?”, the question is almost always a bundle of two distinct architectural concerns:

1. Tool layer: Can the agent only call the tools we approved? Are the tool inputs and outputs validated? Are credentials kept out of the LLM’s context? Are calls audited?
2. Sandbox layer: When a tool runs code, browses the web, or shells out — is that execution isolated from the host? Can it reach internal networks? Can it write outside its working directory?

These look adjacent, but they fail differently. A tool layer fails when an agent calls something it shouldn’t have access to — fixable by tightening the tool registry. A sandbox layer fails when an approved tool gets compromised mid-execution (e.g., a Chromium zero-day exploited via a malicious page) — fixable only by reducing what the execution environment can reach.