forcecage

To contain untrusted code, you build a pre-tested containment boundary that defines exact allowed surfaces and blocks defined actions before any execution occurs. This prevents leakage by ensuring the boundary exists prior to running the subject.

A pre-tested containment boundary is a secure enclosure for untrusted code or agents that runs probes to confirm enforcement. It allows you to observe and control risk in sandbox-style experiments before any action leaves the cage.

You set up audit logs by running self-test probes inside the containment boundary to confirm enforcement. The system observes the subject during execution and logs any violations for audit before allowing release.

Yes, you can specify explicit release conditions to descend from a containment cage to a less restricted environment. This release-aware execution ensures criteria are met before any action leaves the boundary.

You need a containment boundary when running untrusted agents or risky code where risk must be observed and controlled. It is applicable for pre-run containment and scenarios requiring observation before release to production.

Yes, this containment approach works without external dependencies. You can build the boundary, run the subject inside, observe the results, and enforce release criteria entirely within the defined environment.