Every sandbox ends up with exceptions

An agent that can file a ticket is useful. An agent that can also close one, refund the customer and push a config change has enough reach to do real damage. This panel gets into architectures people have actually shipped — container-level isolation, scoped credentials, network egress rules, approval gates on destructive operations — and asks whether a well-designed sandbox genuinely contains an agent, or whether every deployment accumulates exceptions until the boundary is decorative. The panelists share where their own boundaries have bent, and what it takes to keep an agent useful without handing it the keys.