Sandbox and Least Privilege

01 · 修一份文件，为什么要拿到公司银行卡01 · Why does editing one file require the company card?

Agent 只需读取项目文件。若继续给它网络与支付权限，一条被注入的指令能走出的真实攻击路径会扩大多少？An agent only needs to read a project file. If it also gets network and payment access, how many real attack paths can an injected instruction reach?

02逐项授予文件、网络与支付权限，观察攻击路径图扩张与沙箱外阻断Grant File, Network, and Payment Access One by One; Watch the Attack Graph Expand and the Sandbox Boundary Hold

权限增量 · 影响半径permission delta · blast radius

状态 AMetric A

—

状态 BMetric B

—

状态 CMetric C

—

所有概率、成本、成功率与输出均为固定种子的教学模拟，不代表真实模型输出。把主变量拖回即可复核结论。All probabilities, costs, success rates, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.

03把刚才的变化拆成 4 个零件Break the Change into Four Parts

Sandbox and Least Privilege

SANDBOX

隔离边界Sandbox boundary

进程、文件与网络命名空间限制可触达资源。Process, file, and network namespaces bound reachable resources.

MINIMUM

最小授权Minimum grant

任务只需文件读取，就不授予网络与支付。If the task needs file read only, do not grant network or payment.

ENFORCE

运行时执行Runtime enforcement

权限由系统层检查，不依赖模型自我约束。System controls enforce access; the model does not police itself.

BLAST

影响半径Blast radius

每个新权限都增加可组合的攻击路径。Every new permission adds attack paths that can combine.

04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction

MECHANISM

reachable_resources = sandbox_scope ∩ granted_permissions

主交互中权限逐项增加会扩大沙箱内攻击路径；沙箱外交付库始终不在交集内，因此保持不可触达。Each grant expands in-sandbox attack paths. The outside production vault never enters the intersection, so it remains unreachable.

定义任务需要Define need只需读项目文件project read only

逐项授权Grant文件 / 网络 / 支付file / network / payment

系统层阻断Enforce沙箱外始终不可达outside always unreachable

05一次性授予文件、网络和支付全部权限Grant File, Network, and Payment Access All at Once

主动制造失败Create a failure

边界实验Boundary experiment

攻击路径会从一条读路径扩为读取—外传—支付的组合链；沙箱边界仍会阻止访问生产密钥库。The attack graph expands from one read path into read-exfiltrate-pay chains, while the sandbox still blocks the production vault.

尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction first.

✗ 提示里写“不要作恶”就是沙箱。A “do no harm” prompt is a sandbox.→ ✓ 沙箱是系统执行边界，不依赖模型遵守。A sandbox is a system boundary, independent of model compliance.

✗ 先给全权限，之后再审计。Grant everything, audit later.→ ✓ 权限应按任务最小化并逐项可撤销。Permissions should be task-minimal and individually revocable.

✗ 沙箱内有权限，就能触达所有系统。In-sandbox access reaches every system.→ ✓ 沙箱范围与授权取交集，边界外资源仍不可达。Reachability is the intersection of scope and grants; outside resources remain blocked.

06 · 一句话带走06 · One line to keep

最小权限只开放任务必需能力，沙箱再把执行限制在隔离边界；每新增一项授权都会扩大攻击路径，但边界外资源仍不可触达。Least privilege opens only task-required abilities, while the sandbox confines execution. Every added grant expands attack paths, but resources outside the boundary remain unreachable.