Governance · Lesson 02 of 03
Crossings and sandbox enforcement
Crossing authority admits one exact governed operation; sandbox enforcement applies provider-bounded runtime controls to the selected lane.
Learning objectives
- Distinguish crossing authority from sandbox enforcement
- Explain why a grant cannot widen or bypass agent admission
- Identify claims the first OCI enforcement adapter must refuse
Prerequisites
Audited crossings and sandbox enforcement solve different problems. A crossing supplies bounded authority for an otherwise governed operation. A sandbox applies runtime filesystem, network, platform, and lifecycle controls at an enforcing provider boundary.
Crossing evidence is exact and single-use
Ota binds each crossing transaction and record to the semantic contract, selected closure, execution selection, actor mode, classification, work unit, freshness, and carrier evidence. A narrowly scoped grant may be reusable within its own lifetime, but it is rechecked for every crossing and cannot authorize a changed closure. Crossing evidence from one run never authorizes another run, makes a task agent-safe, or bypasses --agent.
ota run --agent --grant approved-release --receipt --json releaseSandbox claims are provider-bounded
The first OCI enforcement adapter can apply selected-lane controls such as a read-only repository, declared writable carve-outs, protected paths, external-network denial, platform selection, and exact cleanup. It refuses unsupported services, persistent state, managed isolated paths, or targeted egress rather than pretending enforcement.
ota run --agent --sandbox-target oci_local --receipt --json verifyCanonical terminology
Evidence boundary for this lesson
Establishes
- The worked examples establish the lesson's canonical Ota distinctions for its stated scope.
Does not establish
- Reading the lesson does not validate a repository, execute its tasks, or establish organizational acceptance.
Knowledge check
Why can a valid crossing grant not replace sandbox enforcement?
The grant supplies authority for one exact scope. The sandbox is the provider boundary that applies filesystem, network, platform, and cleanup controls during execution.