A sandbox contains. It does not authorize.
I used to treat a tight box as the answer. Seatbelt. Landlock. A container. The process had less room. I still did not have allow or deny on the tool call.
A sandbox contains the process. rv authorizes the action. Seatbelt or Landlock bound blast radius. A container or VM would also be containment. rv does not attach one. They do not return allow or deny on the tool call.
Containment vs a verdict. Those are different layers.
What a sandbox does
A sandbox bounds what the process can reach if it runs. On macOS, rv can attach Seatbelt. On Linux, Landlock. Windows has no OS sandbox. Wrapper and hook only. Attach is the host or the host, not rv setup. There is no rv sandbox command and no rv setup --os-sandbox.
A container or a VM can isolate a whole process. That is still containment, general, not a rv feature. rv does not attach one. The blast radius shrinks. The tool call still happens unless something else says no.
rv doctor reports what the platform can do. It does not prove a child session is sandboxed. I run doctor after install. I do not treat a green doctor line as a deny I watched.
Absolute-path binaries and non-proxy traffic can sit outside a given surface. A contained process can still run the command the hook never saw.
What authorize means
Agents generate actions. rv authorizes them before they run, when the host hook fires. That is hook grade. It does not replace the host wrapper or OS sandbox. Hermes pre_llm_call cannot veto.
Seatbelt and Landlock do not emit a policy allow or deny. Kernel EPERM is contain, not a tool-call verdict. Landlock network is not a full network deny. The hook can return allow or deny. On OpenCode the visible deny is denied: a toast titled denied, a tool error like denied <context>: <detail>, or the fallback denied this command. Other hosts use other deny strings. It is not a [rv] DENIED line.
OpenCode leftover unused ask does not show an ask screen. I do not describe one.
I prove the OpenCode path in Trigger a known OpenCode deny before you leave. If the hook never fires, the action already ran. I wrote that in If a hook never fires, the action already ran. Prompt text is not this layer either. That split is A prompt can agree and still emit the delete. How the check works is in Runtime guardrails decide allow, ask, or deny before the tool runs.
Why I still want both
I want the box small. I also want a verdict on the action in front of me.
A leftover unused ask is not a sandbox. On an attended coding host it is allow. Unattended and CI harden leftover unused ask to deny with existing --ci or a truthy CI / RYK_CI / RYK_UNATTENDED / RYK_NONINTERACTIVE. There is no rv unattended command. I wrote that hole in An unattended agent has no one to click ask.
Containment without a verdict is a smaller mess. A verdict without a hook is a comfort object. I want the process contained, and I want the tool call gated.
How I start
curl -fsSL https://rykanv.com/install | sh
rv setup
Then the host. rv setup is first-run. It creates workspace local packs if missing. Curl plus the host command alone skips that.
Install is on the docs. Other posts are on the blog. I start from rykanv.com.
A sandbox contains. It does not authorize. I want both layers, and I do not confuse them.