Sandboxing and isolation
A sandbox limits the files, network, and system resources available to a process. Approval decides whether an action is allowed; isolation determines its execution environment. Inspect both.
Desktop checks first
Open Settings > Kernel to inspect executor detection, capabilities, and limitations. Check the session permission control separately. A model name identifies the requested service, not the executor or sandbox.
| Target | Inspect | Do not infer |
|---|---|---|
| EvoX executor | Kernel settings, permission control, and actual requests | Fewer approvals do not prove access to every file or destination |
| External Agent | The host's own permission and runtime settings | An EvoX project connection does not replace host isolation |
| Local MCP | Command, OS account, and server configuration | stdio does not declare a sandbox |
| Browser | Dedicated or daily-Chrome identity and site grants | Separate cookies do not isolate files or revoke website grants |
Full access requests the sandbox strength allowed by the surface. Inspect both approval and confinement changes. If detection fails or access elevation is requested, stop and fix the environment or narrow scope. Never probe isolation using real secrets, production targets, or destructive commands. See executors and external Agents.
The following tiers and fields are for standalone Evolver integration and validation, not universal Desktop tool settings.
Separate execution environments
Desktop tools, local MCP processes, browsers, and standalone Evolver validators use distinct execution paths. Check the actual executor and its filesystem and network configuration. Do not transfer one path's guarantees to another. Per-session browser cookies separate login state, not project files.
Evolver validation tiers
| Tier | Boundary |
|---|---|
| read-only | No network, hidden home, read-only root, and cgroup resource limits |
| no-network | Private root, read-only work copy, private HOME and process space, no network; no aggregate cgroup limits |
| none | Process and path hardening without namespace isolation |
These namespace boundaries belong to Linux validation. This validator does not provide them on Windows or macOS; commands retain access to the network and user home.
Check evidence
Save the actual isolationTier, results, and skipped reasons. The validator rejects execution before launch when required minimum isolation is unavailable. A passed: true result for an empty command list proves no checks ran. Inspect results and skipped individually.