Tool calls make model output executable, so the allowlist is a pre-production review item

Two of the controls in that walkthrough look redundant and are not. The tool registry rejects unknown tool names and validates parameters against a JSON Schema before anything runs, and the file-read handler then resolves the path again and refuses anything outside its data directory ^[9]. Read the schema and the reason for both becomes clear: the path pattern permits word characters, hyphens, slashes and dots ^[10], so `../../etc/passwd` matches it cleanly ^[2]. Schema validation constrains shape. The handler is the only layer constraining meaning.

The handler has its own soft spot. It compares resolved paths with a string prefix test rather than a path-component test, so `/var/app/data-old/secrets` satisfies the guard while sitting outside the directory the guard exists to protect, and a parameter of `../data-old/secrets` gets there through a regex that already allows dots and slashes ^[3].

The code sandbox has the same shape of near-miss, and it is arithmetic rather than judgement. The child process gets 50 MB of address space, 10 seconds of CPU and 10 file descriptors ^[13], under a default wall-clock timeout of five seconds ^[12]. At that default the CPU limit never binds, because the wall clock fires at half the allowance; the rlimit only becomes the operative control if a caller passes a timeout above ten seconds ^[1]. Three of those ten descriptors are the standard streams, leaving seven for the program's own opens ^[4]. And the comment attributing "no network sockets" to the descriptor cap is doing work the post assigns elsewhere: socket-level restriction is the seccomp filter it recommends as a separate, higher layer ^[5].

The layering is the argument. An allowlist of predefined, validated tool schemas is a declaration of everything the agent may ever do, enforced before a handler is reached ^[8]. A container with all capabilities dropped, no-new-privileges, a read-only root and a tmpfs is the assumption that the first layer will be wrong at some point ^[15]. gVisor or Firecracker is what you reach for when the code is user-supplied or the tenancy is shared ^[16]. None of that is novel security engineering; the post is explicit that these are the attack classes that have been hitting web applications for decades ^[7], now sitting behind a component whose output is executed rather than displayed ^[3].

What changes is where the review happens. In a text-only integration the worst outcome is a bad paragraph ^[2]. Once the model chooses tool calls, an injected document is an instruction set ^[4], an unconstrained shell tool is a remote command interface ^[5], and an HTTP tool without a domain restriction is an SSRF probe pointed at your own network ^[6]. Every one of those is decided at registration time by whoever wrote the schema, which is the only moment a human is reliably in the loop. The complaint the post opens with, that most tutorials stop before exploitation ^[17], is a documentation habit with a production tail: teams ship the loop and leave the parameter validation for later, and later is set by the first attacker who can get text into the agent's context.