Sandbox levels (ADR-0010)

Tools declare what they do. Sandboxes choose isolation accordingly.

Side-effect declarations

Every tool registers its side effects:

• network — outbound HTTP / sockets
• filesystem — read / write
• shell — process exec
• db — database mutation
• payment — money movement
• pii — touches personal data

The runtime uses these to:

1. Pick an appropriate sandbox tier.
2. Enforce capability checks before the call.
3. Annotate audit events with the actual side effects observed.

Sandbox tiers

Source: ADR-0010.