Agents can read files, call APIs and run code on your behalf. That makes them powerful, and it means the infrastructure underneath them deserves the same scrutiny as any production system.

Isolation

• Run every agent task in its own sandbox.

• Use default-deny network policies and allow only what's needed.

• Never share a sandbox between customers or tenants.

Secrets

• Inject secrets at runtime instead of baking them into images.

• Use short-lived tokens wherever possible.

• Rotate keys automatically and after every incident.

Access control

• Enforce single sign-on for your team.

• Use role-based access so people only see the projects they work on.

• Require approval for production deployments.

Audit and compliance

Keep an audit log of who started which sandbox, with which permissions and what it accessed. Codexa provides these logs out of the box and is built to support SOC 2 and GDPR requirements.

Use this checklist as a starting point and adapt it to your own risk profile. Security is never finished, but these basics cover the majority of real-world incidents.