Capability Control, Approvals, Sandboxing, and Rollback

Capability control constrains the resources, operations, destinations, and time windows available to an agent. Approvals, sandboxes, staging, transactional design, and rollback reduce the consequences of imperfect planning or hostile inputs. Each limits a different thing: what the agent can reach, what it can do once there, when it commits, and what can be undone afterwards.

Containment is not one switch. A sandbox can restrict execution and still allow harmful network access, data exfiltration, excessive cost, or destructive changes inside its boundary. And the boundary is not a law of nature. It is software, and software has a version number and a CVE.

The reference Filesystem server of the Model Context Protocol had two ways of reaching files outside its allowed directories. Both were disclosed on 1–2 July 2025. CVE-2025-53109 bypasses path validation through prefix matching and symlink handling. CVE-2025-53110 does it through a colliding path prefix. Both scored 7.3, High. Both were fixed by upgrading to 0.6.4 or 2025.7.01.

The advisory for the first states the mechanism plainly: “Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories.” The allow-list was configured correctly. A symlink placed inside a directory the agent was permitted to read carried the read out of the permitted set. One of the four limits — reach — failed on its own. The other three were never consulted.

Containment is layered rather than switched on. Least privilege, Isolation, Commit gates, and Reversibility each catch a different mistake. Least privilege is not a slogan here but a published tenet: NIST SP 800-207 grants access to individual enterprise resources on a per-session basis, with the least privileges needed to complete the task. Reversibility and Kill and recover need owners of their own, and tests of their own. The Knight Capital order later in this lesson is what an untested recovery step costs. No single layer holds on its own. A sandbox with a live credential in it is a sandbox in name only, and a directory allow-list is only as good as the path-validation code underneath it.

Blast radius comes first, and it is measured by what disappears together. On 8 May 2024 UniSuper and Google Cloud jointly disclosed that a misconfiguration during provisioning had deleted UniSuper's Google Cloud VMware Engine Private Cloud subscription. It went in both of the geographies UniSuper used for redundancy. Google Cloud's incident report of 24 May 2024 traced the deletion to one input parameter left blank in an internal provisioning tool. The system assigned an unknown default fixed one-year term. At the end of that term the Private Cloud was deleted, with no customer notification.

Two geographies sounded like two copies. They were two copies inside one subscription, and the subscription was the unit that was deleted. The layer that actually held was the one outside that unit, and the joint statement says which it was: “UniSuper had backups in place with an additional service provider. These backups have minimised data loss, and significantly improved the ability of UniSuper and Google Cloud to complete the restoration.”

Ask an agent the same question in advance. Name the thing that would have to fail for every copy to go at once. Then check that at least one copy is not inside it.

A correct configuration diff was generated. It was then applied to the production project, because the same credential covered staging and production. No approval separated preview from commit. One key opened both, so the diff and the damage were one step apart.

A numbered standard is written against that failure. Access to individual enterprise resources is granted on a per-session basis, with the least privileges needed to complete the task. That is the third basic tenet of NIST Special Publication 800-207, Zero Trust Architecture, published in August 2020. The tenet then closes the door the shared credential leaves open: “However, authentication and authorization to one resource will not automatically grant access to a different resource.”

Read that as an engineering requirement rather than a principle. The staging project and the production project are two resources. A credential that authorizes the agent for the first must not, by that fact alone, authorize it for the second. The authority has to be issued per session, scoped to the resource in hand, and expire. Where one key opens both, the containment argument for the whole run reduces to the hope that the agent addresses the right project. Hope is not a limit on reach.

Plan containment for a specific workflow rather than in the abstract, because the layers depend on which credentials and environments that workflow already touches. Partition the environment. Scope each credential to resource, action, destination, budget and expiry. Stage material changes as previews or pending transactions. Place informed approvals. Exercise rollback.

The last step is the one that gets written down and never run. A regulatory order describes what that costs. On 1 August 2012 new code was copied to only seven of Knight Capital's eight SMARS servers, with no second-technician review. The eighth server still carried retired “Power Peg” code, which a repurposed flag activated. In roughly 45 minutes SMARS produced over 4 million executions in 154 stocks, for more than 397 million shares and a loss of over $460 million. Knight had no incident-response procedures. The SEC's order of 16 October 2013 records what the recovery attempt did: “In one of its attempts to address the problem, Knight uninstalled the new RLP code from the seven servers where it had been deployed correctly. This action worsened the problem, causing additional incoming parent orders to activate the Power Peg code that was present on those servers, similar to what had already occurred on the eighth server.” Knight paid a $12,000,000 civil money penalty for violating Rule 15c3-5.

Every layer in the plan appears in that passage as an absence. The deployment was partial and no second technician checked it. The stale code path was still reachable, so nothing limited what the system could run. The rollback was improvised during the incident, on a partially deployed fleet, and it spread the failure to the seven servers that had been correct. Exercising rollback means running it. On a system in a partial state. Before the day when four million executions depend on it.

Begin deployment in advisory or staged mode. Expand direct authority only after the same controls and evaluations demonstrate bounded, recoverable behavior. Recoverable means demonstrated, in the way Knight's uninstall was not.

Before widening a permission, look again at the way approval degrades. Look at it as a measured rate rather than a worry. 70.2% clickthrough on Chrome SSL warnings, across more than 25 million impressions. 49% to 96% override on drug safety alerts, across 17 studies. Adding an approval step to a wider permission does not restore the containment the wider permission removed. It adds a prompt to the pile that produced those rates. The check that tells you containment still holds is the structural one you started from, tenet 3 of NIST SP 800-207: authorization to one resource does not carry to another. Its operational form is simpler still. A run gone wrong still cannot touch an unrelated tenant or environment.