Agent sandboxes

Boundaries that control what an agent can read, run and reach.