Environment Boundaries and Constraints › Scope Constraints: Defining the Sandbox

## Example (Claude Sonnet 4.5)
## Using Claude Sonnet 4.5 for its careful reasoning about file system safety

import os
from pathlib import Path


class FileSystemBoundary:
    def __init__(self, allowed_paths):
        # Convert to absolute paths and normalize
        self.allowed_paths = [Path(p).resolve() for p in allowed_paths]

    def is_allowed(self, file_path):
        """Check if a file path is within allowed boundaries"""
        try:
            file_path = Path(file_path).resolve()

            # Check if the path is under any allowed directory
            for allowed in self.allowed_paths:
                try:
                    file_path.relative_to(allowed)
                    return True
                except ValueError:
                    continue

            return False
        except Exception:
            return False


## Agent can only access files in these directories
fs_boundary = FileSystemBoundary(
    allowed_paths=["/home/user/documents/agent_workspace", "/home/user/notes"]
)

## Test some paths
test_paths = [
    "/home/user/documents/agent_workspace/data.txt",  # Allowed
    "/home/user/notes/meeting.txt",  # Allowed
    "/home/user/.ssh/id_rsa",  # Not allowed
    "/etc/passwd",  # Definitely not allowed
]

for path in test_paths:
    allowed = fs_boundary.is_allowed(path)
    print(f"{path}: {'✓ Allowed' if allowed else '✗ Blocked'}")

## Example (Claude Sonnet 4.5)
## Using Claude Sonnet 4.5 for security-conscious network boundary logic

from urllib.parse import urlparse


class NetworkBoundary:
    def __init__(self, allowed_domains, blocked_domains=None):
        self.allowed_domains = set(allowed_domains)
        self.blocked_domains = set(blocked_domains or [])

    def can_access(self, url):
        """Check if the agent can access this URL"""
        try:
            domain = urlparse(url).netloc

            # Check blocklist first
            if domain in self.blocked_domains:
                return False

            # Check allowlist
            if self.allowed_domains:
                return domain in self.allowed_domains

            # If no allowlist, allow by default (except blocked)
            return True

        except Exception:
            return False


## Agent can only access specific APIs
net_boundary = NetworkBoundary(
    allowed_domains=[
        "api.weather.com",
        "api.calendar.google.com",
        "api.openai.com",
    ],
    blocked_domains=["malicious-site.com"],
)

## Test some URLs
if net_boundary.can_access("https://api.weather.com/forecast"):
    print("✓ Can fetch weather data")

if not net_boundary.can_access("https://random-website.com"):
    print("✗ Cannot access arbitrary websites")